{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [ "bpfcc-tools", "bpftrace", "ieee-data", "libbpfcc", "libc-dev-bin", "libc6-dev", "libclang-cpp22", "libclang1-22", "libllvm22", "libupki-openssl1", "linux-headers-7.3.0-8", "linux-headers-7.3.0-8-generic", "linux-image-7.3.0-8-generic", "linux-libc-dev", "linux-main-modules-zfs-7.3.0-8-generic", "linux-modules-7.3.0-8-generic", "linux-tools-7.3.0-8", "linux-tools-7.3.0-8-generic", "manpages-dev", "python3-bpfcc", "python3-netaddr", "systemd-tpm", "upki" ], "removed": [ "linux-headers-7.3.0-5", "linux-headers-7.3.0-5-generic", "linux-image-7.3.0-5-generic", "linux-main-modules-zfs-7.3.0-5-generic", "linux-modules-7.3.0-5-generic", "linux-tools-7.3.0-5", "linux-tools-7.3.0-5-generic" ], "diff": [ "apparmor", "bpftool", "bsdextrautils", "bsdutils", "busybox", "curl", "dhcpcd-base", "diffutils", "distro-info", "dpkg", "eject", "fdisk", "gcc-16-base", "iproute2", "libacl1", "libapparmor1", "libatomic1", "libblkid1", "libcap-ng0", "libcurl3t64-gnutls", "libcurl4t64", "libexpat1", "libfdisk1", "libfreetype6", "libgcc-s1", "libjs-sphinxdoc", "liblastlog2-2", "libmount1", "libnetplan1", "libnpth0t64", "libnss-systemd", "libopeniscsiusr", "libpam-systemd", "libparted2t64", "libpcap0.8t64", "libpng16-16t64", "libpython3.14", "libpython3.14-minimal", "libpython3.14-stdlib", "libselinux1", "libsmartcols1", "libssh2-1t64", "libssl4", "libstdc++6", "libsystemd-shared", "libsystemd0", "libudev1", "libuuid1", "linux-headers-generic", "linux-headers-virtual", "linux-image-virtual", "linux-perf", "linux-tools-common", "linux-virtual", "login", "login.defs", "mount", "netplan-generator", "netplan.io", "open-iscsi", "openssl", "openssl-provider-legacy", "parted", "passwd", "python3-dateutil", "python3-distro-info", "python3-distupgrade", "python3-launchpadlib", "python3-netplan", "python3-requests", "python3-software-properties", "python3-typing-extensions", "python3-urllib3", "python3.14", "python3.14-gdbm", "python3.14-minimal", "rsync", "rust-coreutils", "software-properties-common", "sudo", "sudo-rs", "systemd", "systemd-cryptsetup", "systemd-hwe-hwdb", "systemd-resolved", "systemd-sysv", "tar", "tzdata", "ubuntu-release-upgrader-core", "udev", "update-notifier-common", "util-linux", "util-linux-extra", "uuid-runtime" ] } }, "diff": { "deb": [ { "name": "apparmor", "from_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu1", "version": "6.0.0~alpha1-0ubuntu1" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu3", "version": "6.0.0~alpha1-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2163559, 2168731, 2166999, 2166999, 2167200 ], "changes": [ { "cves": [], "log": [ "", " * Add patch to fix who username lookups (LP: #2163559)", " - d/p/u/profiles-who-add-rules-Rust-coreutils-username-lookup.patch", " * Update patch to fix loupe opening in more directories (LP: #2168731)", " - d/p/u/0004-rewrite-the-loupe-profile.patch", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163559, 2168731 ], "author": "Ryan Lee ", "date": "Thu, 24 Sep 2026 09:57:27 -0700" }, { "cves": [], "log": [ "", " * Add and update patches to fix loupe (LP: #2166999):", " - d/p/u/0001-profiles-add-a-glycin-tunable.patch", " - d/p/u/0002-profiles-begin-adding-abstractions-for-the-XDG-Deskt.patch", " - d/p/u/0003-profiles-add-dconf-dbus-write-abstraction.patch", " - d/p/u/0003-rewrite-the-loupe-profile.patch ->", " d/p/u/0004-rewrite-the-loupe-profile.patch", " * Add patch to fix glycin bwrap (LP: #2166999):", " - d/p/u/fix_glycin_bwrap.patch", " * Add patch to fix samba-rpcd SAMR socket access (LP: #2167200):", " - d/p/u/samba-rpcd-add-SAMR-socket-permissions.patch", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166999, 2166999, 2167200 ], "author": "Ryan Lee ", "date": "Wed, 16 Sep 2026 12:57:36 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "bpftool", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.8.0+7.3.0-5.5" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.8.0+7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdextrautils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "bsdutils", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "1:2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "1:2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "busybox", "from_version": { "source_package_name": "busybox", "source_package_version": "1:1.38.0-3ubuntu3", "version": "1:1.38.0-3ubuntu3" }, "to_version": { "source_package_name": "busybox", "source_package_version": "1:1.38.0-3ubuntu4", "version": "1:1.38.0-3ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * d/tests/: Add autopkgtest support", "" ], "package": "busybox", "version": "1:1.38.0-3ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Pierre-Elliott Bécue ", "date": "Thu, 24 Sep 2026 17:50:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "curl", "from_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu3", "version": "8.20.0-2ubuntu3" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu11", "version": "8.20.0-2ubuntu11" }, "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167691 ], "changes": [ { "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cochran ]", " * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.", " - debian/patches/CVE-2026-13608.patch: openldap: handle", " Curl_sasl_continue() returns better in lib/openldap.c.", " - CVE-2026-13608", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Use after free in OpenSSL library context.", " - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is", " used in lib/vtls/openssl.c.", " - CVE-2026-80229", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie.", " - debian/patches/CVE-2026-80255.patch: improve TAB handling in", " lib/cookie.c, tests/data/Makefile.am, tests/data/test2885.", " - CVE-2026-80255", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am,", " tests/data/test1136, tests/data/test2318, tests/data/test798.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY UPDATE: Use after free in curl_easy_reset.", " - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in", " include/curl/curl.h, lib/http2.c,", " lib/setopt.c, lib/url.c, and lib/urldata.h", " - CVE-2026-10536", " * SECURITY UPDATE: Denial of service in QUIC UDP.", " - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets", " and enforce an upper bound in", " lib/vquic/vquic.c", " - CVE-2026-11352", " * SECURITY UPDATE: Improper certificate validation in native_ca_store.", " - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to", " keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to", " calculate every easy transfer if a native CA store shall be used or", " not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c", " - CVE-2026-11564", " * SECURITY UPDATE: Memory exhaustion in ws.c", " - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless", " there is sufficient space left in the websocket send buffer in", " lib/ws.c.", " - CVE-2026-11586", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", " * SECURITY UPDATE: Improper validation in config2setopts.", " - debian/patches/CVE-2026-12064.patch: Use default protocol properly in", " src/config2setopts.c.", " - CVE-2026-12064", " * SECURITY UPDATE: Connection reuse for starttls protocols.", " - debian/patches/CVE-2026-8286.patch: When a connection is tested for", " reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),", " the SSL configuration must match the existing connection in lib/url.c", " - CVE-2026-8286", " * SECURITY UPDATE: Connection reuse in SASL.", " - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in", " lib/curl_sasl.c, lib/http_negotiate.c, and lib/http_ntlm.c.", " - CVE-2026-8458", " * SECURITY UPDATE: Cookie injection in is_public_suffix.", " - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking", " PSL in lib/cookie.c.", " - CVE-2026-8924", " * SECURITY UPDATE: Double-free in gsasl.", " - debian/patches/CVE-2026-8925.patch: Require libgsasl 1.6.0 to handle", " NULL argument in lib/vauth/gsasl.c.", " - CVE-2026-8925", " * SECURITY UPDATE: Information disclosure in netrc.", " - debian/patches/CVE-2026-8926.patch: Do not return a password from", " parsenetrc() when the requested login did not match the credentials", " found for the matched machine in lib/netrc.c.", " - CVE-2026-8926", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as", " previous and flush state in lib/url.c and lib/urldata.h.", " - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials", " in lib/setopt.c.", " - debian/patches/CVE-2026-9545.patch: Hard fail when certificate", " verification fails in lib/vquic/curl_ngtcp2.c.", " - CVE-2026-8927", " - CVE-2026-9079", " - CVE-2026-9545", " * SECURITY UPDATE: Use-after-free in curl_easy_pause", " - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to", " assert against NULL pointers in lib/multi_ev.c", " - debian/patches/CVE-2026-9080-post1.patch: Refresh sock entry after", " remove callback in lib/multi_ev.c", " - CVE-2026-9080", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-9546.patch: clear referer in lib/transfer.c", " - CVE-2026-9546", " * SECURITY UPDATE: Man-in-the-middle in libcurl.", " - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in", " lib/vssh/libssh.c.", " - CVE-2026-9547", "" ], "package": "curl", "version": "8.20.0-2ubuntu11", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Wed, 23 Sep 2026 15:00:22 -0600" }, { "cves": [], "log": [ "", " * Fix typo that inadvertently enabled upki -dev dependency on i386", "" ], "package": "curl", "version": "8.20.0-2ubuntu10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 22 Sep 2026 11:20:58 +0200" }, { "cves": [], "log": [ "", " * REVERT broken 8.20.0-2ubuntu4 SECURITY upload", " - `checksrc` fixes in 8.20.0-2ubuntu7 were ok", " - but CVE 2026-8927 was incorrectly backported and the tests failed", " - see LP #2167779 for more details", " * upki fixes:", " - libcurl4-openssl-dev: depend on libupki-openssl-dev", " - fix #if defined() to ifdef", " - fix old style c issue in autopkgtest checksrc", "" ], "package": "curl", "version": "8.20.0-2ubuntu9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Sun, 20 Sep 2026 00:08:57 +0200" }, { "cves": [], "log": [ "", " * Include upki integration for OpenSSL build (LP: #2167691),", " excluding s390x (big endian) and i386 (no upki)", " * fix checksrc-warning from cve fix", "" ], "package": "curl", "version": "8.20.0-2ubuntu7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167691 ], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 17:50:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dhcpcd-base", "from_version": { "source_package_name": "dhcpcd", "source_package_version": "1:10.3.2-6", "version": "1:10.3.2-6" }, "to_version": { "source_package_name": "dhcpcd", "source_package_version": "1:10.5.2-6", "version": "1:10.5.2-6" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * [patches]", " + 0002: Fix stdout/stderr not closed when daemonising (Closes: #1149297).", "" ], "package": "dhcpcd", "version": "1:10.5.2-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Wed, 30 Sep 2026 07:48:01 +0300" }, { "cves": [], "log": [ "", " * [autopkgtest]", " = timesyncd: use active verbs for output text.", "" ], "package": "dhcpcd", "version": "1:10.5.2-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Tue, 22 Sep 2026 14:24:31 +0300" }, { "cves": [], "log": [ "", " * [rules]", " + Add --no-start back to dh_install[init|systemd] to fix autopkgtest.", " * [autopkgtest]", " - Remove superfluous ethtool call and Depends.", "" ], "package": "dhcpcd", "version": "1:10.5.2-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Mon, 07 Sep 2026 20:41:16 +0300" }, { "cves": [], "log": [ "", " * [autopkgtest]", " + Echo mileposts: veth addr, dnsmasq status, timedatectl show-timesync.", "" ], "package": "dhcpcd", "version": "1:10.5.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Mon, 07 Sep 2026 10:20:52 +0300" }, { "cves": [], "log": [ "", " * [systemd]", " - Remove After/Before references to networking.service (Closes: #1146692).", " * [rules]", " - Ensure that monitor mode restarts after an upgrade (Closes: #1146835).", "" ], "package": "dhcpcd", "version": "1:10.5.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Sun, 06 Sep 2026 12:05:01 +0300" }, { "cves": [], "log": [ "", " * New upstream version.", "" ], "package": "dhcpcd", "version": "1:10.5.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Mon, 17 Aug 2026 19:13:55 +0300" }, { "cves": [], "log": [ "", " * New upstream version.", " This version brings extensive code refactoring and some intrusive changes.", " Cautiously uploading to unstable. Please report all regressions upstream.", " * [patches]", " - Drop all recent upstream cherry-picks. They're included in this release.", "" ], "package": "dhcpcd", "version": "1:10.5.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Mon, 17 Aug 2026 14:51:17 +0300" }, { "cves": [], "log": [ "", " * [patches]", " Cherry-pick upstream fixes for regressions:", " + 42307ab3c8aee9dfb99b80ae2086750adb465989.patch", " * [autopkgtest]", " - timesyncd-ntp-servers-from-dhcp: no longer flaky.", "" ], "package": "dhcpcd", "version": "1:10.5.0-4", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Thu, 13 Aug 2026 20:08:28 +0300" }, { "cves": [], "log": [ "", " * [patches]", " Cherry-pick upstream fixes for regressions:", " + 78429f5f4dff60ed56de56ae8524e6f50acee96a.patch", "" ], "package": "dhcpcd", "version": "1:10.5.0-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Wed, 12 Aug 2026 10:48:17 +0000" }, { "cves": [], "log": [ "", " * [patches]", " Cherry-pick upstream fixes for regressions:", " + 0406dd87753049f54b9beb7ab66f333a1d2709d2.patch", " + 9151877f4954f13df3afec25e5d677927a2b8b72.patch", "" ], "package": "dhcpcd", "version": "1:10.5.0-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Tue, 11 Aug 2026 19:06:11 +0300" }, { "cves": [], "log": [ "", " * New upstream version.", " This version brings extensive code refactoring and some intrusive changes,", " hence the upload via experimental. Please report all regressions upstream.", " * [patches]", " - Drop all CVE fixes (merged upstream).", " * [control]", " - Build-Depends: openntpd [hurd-any]. Try building Hurd without NTP hooks.", "" ], "package": "dhcpcd", "version": "1:10.5.0-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Martin-Éric Racine ", "date": "Wed, 05 Aug 2026 16:04:53 +0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "diffutils", "from_version": { "source_package_name": "diffutils", "source_package_version": "1:3.12-1", "version": "1:3.12-1" }, "to_version": { "source_package_name": "diffutils", "source_package_version": "1:3.12-1ubuntu2", "version": "1:3.12-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2148301, 2166741 ], "changes": [ { "cves": [], "log": [ "", " * Use GNU chmod and rm for test cleanup to work around the rust-coreutils", " EOVERFLOW issue affecting 32-bit builds (LP: #2148301, LP: #2166741).", " * Build-depend on gnu-coreutils.", "" ], "package": "diffutils", "version": "1:3.12-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2148301, 2166741 ], "author": "Zineb Zaadoud ", "date": "Mon, 14 Sep 2026 19:59:28 +0200" }, { "cves": [ { "cve": "CVE-2026-53910", "url": "https://ubuntu.com/security/CVE-2026-53910", "cve_description": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815  NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges.", "cve_priority": "medium", "cve_public_date": "2026-07-22 14:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Integer Overflow", " - debian/patches/CVE-2026-53910-1.patch: diff3: check for integer overflows", " when reading line numbers from diff in NEWS, THANKS, src/diff3.c.", " - debian/patches/CVE-2026-53910-2.patch: diff3: prevent overflow in line", " offsets in src/diff3.c.", " - CVE-2026-53910", "" ], "package": "diffutils", "version": "1:3.12-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 31 Aug 2026 08:14:48 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "distro-info", "from_version": { "source_package_name": "distro-info", "source_package_version": "1.17", "version": "1.17" }, "to_version": { "source_package_name": "distro-info", "source_package_version": "1.19", "version": "1.19" }, "cves": [], "launchpad_bugs_fixed": [ 2131678 ], "changes": [ { "cves": [], "log": [ "", " * Makefile: remove python/.mypy_cache on clean", "" ], "package": "distro-info", "version": "1.19", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Tue, 29 Sep 2026 12:41:41 +0200" }, { "cves": [], "log": [ "", " * Support Ubuntu Pro with Legacy add-on (LP: #2131678):", " - ubuntu-distro-info: add --supported-legacy", " - python: add UbuntuDistroInfo.supported_legacy", " - perl: add UbuntuDistroInfo.supported_legacy", " * Add test cases for ubuntu-distro-info --supported-esm", "" ], "package": "distro-info", "version": "1.18", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2131678 ], "author": "Benjamin Drung ", "date": "Mon, 28 Sep 2026 16:01:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "dpkg", "from_version": { "source_package_name": "dpkg", "source_package_version": "1.23.7ubuntu1", "version": "1.23.7ubuntu1" }, "to_version": { "source_package_name": "dpkg", "source_package_version": "1.23.7ubuntu2", "version": "1.23.7ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2147638 ], "changes": [ { "cves": [], "log": [ "", " * Improve handling of coreutils build-depends.", " Inject a coreutils-from-uutils build dependency unless the", " package Build-Depends on coreutils-from-gnu (LP: #2147638)", "" ], "package": "dpkg", "version": "1.23.7ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2147638 ], "author": "Julian Andres Klode ", "date": "Wed, 16 Sep 2026 22:38:47 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "eject", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "fdisk", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "gcc-16-base", "from_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-2ubuntu1", "version": "16.2.0-2ubuntu1" }, "to_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-3ubuntu1", "version": "16.2.0-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Build from upstream sources.", "" ], "package": "gcc-16", "version": "16.2.0-3ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:36:18 +0200" }, { "cves": [], "log": [ "", " * Update to git 20260918 from the gcc-16 branch.", " - Fix PR target/127306 (RISCV), PR target/127318 (RISCV),", " PR target/127153 (loongarch), PR target/126932 (RISCV),", " PR middle-end/127256, PR target/126463 (AArch64),", " PR target/126196 (RISCV), PR rtl-optimization/125683, PR debug/125421,", " PR target/127188 (RISCV), PR c++/125642, PR c++/127207, PR c++/123495,", " PR c++/126860, PR c++/124983, PR fortran/127128, PR libstdc++/124121,", " PR libstdc++/127220, PR libstdc++/127219, PR libstdc++/126949,", " PR libstdc++/127325, PR libstdc++/126800, PR target/122535 (PPC),", " PR tree-optimization/127390, PR tree-optimization/127377,", " PR tree-optimization/127262, PR tree-optimization/127130,", " PR tree-optimization/127049, PR tree-optimization/127000,", " PR tree-optimization/127000, PR tree-optimization/126760,", " PR tree-optimization/127391, PR tree-optimization/126658, PR ipa/126153,", " PR tree-optimization/126153, PR ipa/126153, PR libstdc++/127430.", " * Strip compiler executables for release builds. Closes: #1147241.", " * Bootstrap using gnat-14, to be able to remove GCC 15.", " * Add comment why libstdc++.so in the gcc_lib_dir needs to be copy", " of the library, not a symlink.", " * Apply PR target/120165 (m68k only), taken from the trunk.", "" ], "package": "gcc-16", "version": "16.2.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:35:21 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "iproute2", "from_version": { "source_package_name": "iproute2", "source_package_version": "6.19.0-1ubuntu2", "version": "6.19.0-1ubuntu2" }, "to_version": { "source_package_name": "iproute2", "source_package_version": "7.2.0-1ubuntu1", "version": "7.2.0-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge from debian, remaining changes:", " - Ubuntu FAN support", " * patches: Dropped patches that got upstreamed", "" ], "package": "iproute2", "version": "7.2.0-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Timo Aaltonen ", "date": "Wed, 30 Sep 2026 16:15:03 +0300" }, { "cves": [], "log": [ "", " * Update upstream source from tag 'upstream/7.2.0'", "" ], "package": "iproute2", "version": "7.2.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Luca Boccassi ", "date": "Thu, 03 Sep 2026 13:08:27 +0100" }, { "cves": [], "log": [ "", " * d/watch: ignore leading 'v' in version", " * Update upstream source from tag 'upstream/7.1.0'", " * Bump dh compat to 14", " * Drop conffile workaround for pre-Trixie version", "" ], "package": "iproute2", "version": "7.1.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Luca Boccassi ", "date": "Fri, 19 Jun 2026 14:35:55 +0100" }, { "cves": [], "log": [ "", " * Update upstream source from tag 'upstream/7.0.0'", " * Bump Standards-version to 4.7.4, no changes", " * Switch from libselinux1-dev to libselinux-dev", "" ], "package": "iproute2", "version": "7.0.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Luca Boccassi ", "date": "Thu, 16 Apr 2026 14:22:55 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libacl1", "from_version": { "source_package_name": "acl", "source_package_version": "2.3.2-2", "version": "2.3.2-2" }, "to_version": { "source_package_name": "acl", "source_package_version": "2.4.0-1", "version": "2.4.0-1" }, "cves": [ { "cve": "CVE-2026-54369", "url": "https://ubuntu.com/security/CVE-2026-54369", "cve_description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" }, { "cve": "CVE-2026-54370", "url": "https://ubuntu.com/security/CVE-2026-54370", "cve_description": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-54369", "url": "https://ubuntu.com/security/CVE-2026-54369", "cve_description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" }, { "cve": "CVE-2026-54370", "url": "https://ubuntu.com/security/CVE-2026-54370", "cve_description": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-06-29 14:16:00 UTC" } ], "log": [ "", " * New upstream release.", " - Refresh local patches.", " - Remove upstream patches included in this release.", " - Update upstream OpenPGP signing certificates.", " - Update symbols file for new upstream release.", " - Fix symlink traversal vulnerability [CVE-2026-54369].", " - Fix time-of-check to time-of-use (TOCTOU) race condition vulnerability", " [CVE-2026-54370].", " Closes: #1141110", " * Remove build dependency on debhelper (>= 13.10) implied by", " debhelper-compat (= 13) since Debian bookworm.", " * Remove build dependencies on automake, autoconf and libtool implied", " by debhelper-compat (>= 10) since Debian stretch.", " * Switch to Standards-Version 4.7.4 (no changes needed).", " * Refactor common synopsis into a source stanza Description field.", " * Switch debian/watch URL to use the one not affected by mirroring,", " as that has delays of up to a day.", "" ], "package": "acl", "version": "2.4.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Guillem Jover ", "date": "Mon, 29 Jun 2026 23:53:15 +0200" }, { "cves": [], "log": [ "", " * Remove «Rules-Requires-Root: no», which is the current default.", " * Remove «Priority: optional», which is the current default.", " * Switch to debian/watch version 5.", " * Add spaces around make assignment operators to distinguish from shell ones.", " * Remove unused lintian overrides for hardening-no-fortify-functions.", " * Switch to Standards-Version 4.7.3 (no changes needed).", " * Reorganize patches by upstream and local provenance.", " * Fix examples build instructions and Makefile to make them work.", " * Install examples in libacl1-dev.", "" ], "package": "acl", "version": "2.3.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Guillem Jover ", "date": "Sun, 15 Feb 2026 13:55:25 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libapparmor1", "from_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu1", "version": "6.0.0~alpha1-0ubuntu1" }, "to_version": { "source_package_name": "apparmor", "source_package_version": "6.0.0~alpha1-0ubuntu3", "version": "6.0.0~alpha1-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2163559, 2168731, 2166999, 2166999, 2167200 ], "changes": [ { "cves": [], "log": [ "", " * Add patch to fix who username lookups (LP: #2163559)", " - d/p/u/profiles-who-add-rules-Rust-coreutils-username-lookup.patch", " * Update patch to fix loupe opening in more directories (LP: #2168731)", " - d/p/u/0004-rewrite-the-loupe-profile.patch", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163559, 2168731 ], "author": "Ryan Lee ", "date": "Thu, 24 Sep 2026 09:57:27 -0700" }, { "cves": [], "log": [ "", " * Add and update patches to fix loupe (LP: #2166999):", " - d/p/u/0001-profiles-add-a-glycin-tunable.patch", " - d/p/u/0002-profiles-begin-adding-abstractions-for-the-XDG-Deskt.patch", " - d/p/u/0003-profiles-add-dconf-dbus-write-abstraction.patch", " - d/p/u/0003-rewrite-the-loupe-profile.patch ->", " d/p/u/0004-rewrite-the-loupe-profile.patch", " * Add patch to fix glycin bwrap (LP: #2166999):", " - d/p/u/fix_glycin_bwrap.patch", " * Add patch to fix samba-rpcd SAMR socket access (LP: #2167200):", " - d/p/u/samba-rpcd-add-SAMR-socket-permissions.patch", "" ], "package": "apparmor", "version": "6.0.0~alpha1-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166999, 2166999, 2167200 ], "author": "Ryan Lee ", "date": "Wed, 16 Sep 2026 12:57:36 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "libatomic1", "from_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-2ubuntu1", "version": "16.2.0-2ubuntu1" }, "to_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-3ubuntu1", "version": "16.2.0-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Build from upstream sources.", "" ], "package": "gcc-16", "version": "16.2.0-3ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:36:18 +0200" }, { "cves": [], "log": [ "", " * Update to git 20260918 from the gcc-16 branch.", " - Fix PR target/127306 (RISCV), PR target/127318 (RISCV),", " PR target/127153 (loongarch), PR target/126932 (RISCV),", " PR middle-end/127256, PR target/126463 (AArch64),", " PR target/126196 (RISCV), PR rtl-optimization/125683, PR debug/125421,", " PR target/127188 (RISCV), PR c++/125642, PR c++/127207, PR c++/123495,", " PR c++/126860, PR c++/124983, PR fortran/127128, PR libstdc++/124121,", " PR libstdc++/127220, PR libstdc++/127219, PR libstdc++/126949,", " PR libstdc++/127325, PR libstdc++/126800, PR target/122535 (PPC),", " PR tree-optimization/127390, PR tree-optimization/127377,", " PR tree-optimization/127262, PR tree-optimization/127130,", " PR tree-optimization/127049, PR tree-optimization/127000,", " PR tree-optimization/127000, PR tree-optimization/126760,", " PR tree-optimization/127391, PR tree-optimization/126658, PR ipa/126153,", " PR tree-optimization/126153, PR ipa/126153, PR libstdc++/127430.", " * Strip compiler executables for release builds. Closes: #1147241.", " * Bootstrap using gnat-14, to be able to remove GCC 15.", " * Add comment why libstdc++.so in the gcc_lib_dir needs to be copy", " of the library, not a symlink.", " * Apply PR target/120165 (m68k only), taken from the trunk.", "" ], "package": "gcc-16", "version": "16.2.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:35:21 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libblkid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcap-ng0", "from_version": { "source_package_name": "libcap-ng", "source_package_version": "0.9.3-1", "version": "0.9.3-1" }, "to_version": { "source_package_name": "libcap-ng", "source_package_version": "0.9.6-1", "version": "0.9.6-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "libcap-ng", "version": "0.9.6-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Håvard F. Aasen ", "date": "Mon, 14 Sep 2026 20:18:16 +0200" }, { "cves": [], "log": [ "", " [ Helmut Grohne ]", " * Make bluetooth build dependency optional. Closes: #1146424", "" ], "package": "libcap-ng", "version": "0.9.5-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Håvard F. Aasen ", "date": "Wed, 02 Sep 2026 21:59:53 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", " * Fix duplicated file entry in d/copyright.", " * Replace patch by using variable in d/rules.", " * Update years in d/copyright.", " * Update symbols file.", " * Bump to debhelper version 14:", " - Remove all unneeded substvars.", " * Remove unnecessary 'Provides' in Python binary.", " * Add libbluetooth-dev to BD.", "" ], "package": "libcap-ng", "version": "0.9.5-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Håvard F. Aasen ", "date": "Wed, 26 Aug 2026 21:32:42 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl3t64-gnutls", "from_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu3", "version": "8.20.0-2ubuntu3" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu11", "version": "8.20.0-2ubuntu11" }, "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167691 ], "changes": [ { "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cochran ]", " * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.", " - debian/patches/CVE-2026-13608.patch: openldap: handle", " Curl_sasl_continue() returns better in lib/openldap.c.", " - CVE-2026-13608", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Use after free in OpenSSL library context.", " - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is", " used in lib/vtls/openssl.c.", " - CVE-2026-80229", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie.", " - debian/patches/CVE-2026-80255.patch: improve TAB handling in", " lib/cookie.c, tests/data/Makefile.am, tests/data/test2885.", " - CVE-2026-80255", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am,", " tests/data/test1136, tests/data/test2318, tests/data/test798.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY UPDATE: Use after free in curl_easy_reset.", " - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in", " include/curl/curl.h, lib/http2.c,", " lib/setopt.c, lib/url.c, and lib/urldata.h", " - CVE-2026-10536", " * SECURITY UPDATE: Denial of service in QUIC UDP.", " - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets", " and enforce an upper bound in", " lib/vquic/vquic.c", " - CVE-2026-11352", " * SECURITY UPDATE: Improper certificate validation in native_ca_store.", " - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to", " keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to", " calculate every easy transfer if a native CA store shall be used or", " not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c", " - CVE-2026-11564", " * SECURITY UPDATE: Memory exhaustion in ws.c", " - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless", " there is sufficient space left in the websocket send buffer in", " lib/ws.c.", " - CVE-2026-11586", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", " * SECURITY UPDATE: Improper validation in config2setopts.", " - debian/patches/CVE-2026-12064.patch: Use default protocol properly in", " src/config2setopts.c.", " - CVE-2026-12064", " * SECURITY UPDATE: Connection reuse for starttls protocols.", " - debian/patches/CVE-2026-8286.patch: When a connection is tested for", " reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),", " the SSL configuration must match the existing connection in lib/url.c", " - CVE-2026-8286", " * SECURITY UPDATE: Connection reuse in SASL.", " - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in", " lib/curl_sasl.c, lib/http_negotiate.c, and lib/http_ntlm.c.", " - CVE-2026-8458", " * SECURITY UPDATE: Cookie injection in is_public_suffix.", " - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking", " PSL in lib/cookie.c.", " - CVE-2026-8924", " * SECURITY UPDATE: Double-free in gsasl.", " - debian/patches/CVE-2026-8925.patch: Require libgsasl 1.6.0 to handle", " NULL argument in lib/vauth/gsasl.c.", " - CVE-2026-8925", " * SECURITY UPDATE: Information disclosure in netrc.", " - debian/patches/CVE-2026-8926.patch: Do not return a password from", " parsenetrc() when the requested login did not match the credentials", " found for the matched machine in lib/netrc.c.", " - CVE-2026-8926", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as", " previous and flush state in lib/url.c and lib/urldata.h.", " - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials", " in lib/setopt.c.", " - debian/patches/CVE-2026-9545.patch: Hard fail when certificate", " verification fails in lib/vquic/curl_ngtcp2.c.", " - CVE-2026-8927", " - CVE-2026-9079", " - CVE-2026-9545", " * SECURITY UPDATE: Use-after-free in curl_easy_pause", " - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to", " assert against NULL pointers in lib/multi_ev.c", " - debian/patches/CVE-2026-9080-post1.patch: Refresh sock entry after", " remove callback in lib/multi_ev.c", " - CVE-2026-9080", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-9546.patch: clear referer in lib/transfer.c", " - CVE-2026-9546", " * SECURITY UPDATE: Man-in-the-middle in libcurl.", " - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in", " lib/vssh/libssh.c.", " - CVE-2026-9547", "" ], "package": "curl", "version": "8.20.0-2ubuntu11", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Wed, 23 Sep 2026 15:00:22 -0600" }, { "cves": [], "log": [ "", " * Fix typo that inadvertently enabled upki -dev dependency on i386", "" ], "package": "curl", "version": "8.20.0-2ubuntu10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 22 Sep 2026 11:20:58 +0200" }, { "cves": [], "log": [ "", " * REVERT broken 8.20.0-2ubuntu4 SECURITY upload", " - `checksrc` fixes in 8.20.0-2ubuntu7 were ok", " - but CVE 2026-8927 was incorrectly backported and the tests failed", " - see LP #2167779 for more details", " * upki fixes:", " - libcurl4-openssl-dev: depend on libupki-openssl-dev", " - fix #if defined() to ifdef", " - fix old style c issue in autopkgtest checksrc", "" ], "package": "curl", "version": "8.20.0-2ubuntu9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Sun, 20 Sep 2026 00:08:57 +0200" }, { "cves": [], "log": [ "", " * Include upki integration for OpenSSL build (LP: #2167691),", " excluding s390x (big endian) and i386 (no upki)", " * fix checksrc-warning from cve fix", "" ], "package": "curl", "version": "8.20.0-2ubuntu7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167691 ], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 17:50:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libcurl4t64", "from_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu3", "version": "8.20.0-2ubuntu3" }, "to_version": { "source_package_name": "curl", "source_package_version": "8.20.0-2ubuntu11", "version": "8.20.0-2ubuntu11" }, "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167691 ], "changes": [ { "cves": [ { "cve": "CVE-2026-13608", "url": "https://ubuntu.com/security/CVE-2026-13608", "cve_description": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-18924", "url": "https://ubuntu.com/security/CVE-2026-18924", "cve_description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80229", "url": "https://ubuntu.com/security/CVE-2026-80229", "cve_description": "When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles. In OpenSSL 3 provider configurations, libcurl attaches an allocated library context to the easy handle's state and passes it to OpenSSL without acquiring an ownership reference; destroying the easy handle prematurely frees this context while the active connection retains a dangling pointer, leading to a heap-use-after-free upon subsequent I/O or post-handshake operations.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80230", "url": "https://ubuntu.com/security/CVE-2026-80230", "cve_description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-80255", "url": "https://ubuntu.com/security/CVE-2026-80255", "cve_description": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-82209", "url": "https://ubuntu.com/security/CVE-2026-82209", "cve_description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).", "cve_priority": "medium", "cve_public_date": "2026-09-06 18:17:00 UTC" }, { "cve": "CVE-2026-10536", "url": "https://ubuntu.com/security/CVE-2026-10536", "cve_description": "A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during the reset operation.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11352", "url": "https://ubuntu.com/security/CVE-2026-11352", "cve_description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11564", "url": "https://ubuntu.com/security/CVE-2026-11564", "cve_description": "libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11586", "url": "https://ubuntu.com/security/CVE-2026-11586", "cve_description": "By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-11856", "url": "https://ubuntu.com/security/CVE-2026-11856", "cve_description": "Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-12064", "url": "https://ubuntu.com/security/CVE-2026-12064", "cve_description": "When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8286", "url": "https://ubuntu.com/security/CVE-2026-8286", "cve_description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8458", "url": "https://ubuntu.com/security/CVE-2026-8458", "cve_description": "libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different \"services\". libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the code, a request that was issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8924", "url": "https://ubuntu.com/security/CVE-2026-8924", "cve_description": "A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set \"super cookies\" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8925", "url": "https://ubuntu.com/security/CVE-2026-8925", "cve_description": "The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8926", "url": "https://ubuntu.com/security/CVE-2026-8926", "cve_description": "When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL with a username (without a password), like `https://user@example.com/`, curl could wrongly get and use the password for *another* user set in the `.netrc` file for that host if such a one exists and there is no match for the specified user.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-8927", "url": "https://ubuntu.com/security/CVE-2026-8927", "cve_description": "When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9079", "url": "https://ubuntu.com/security/CVE-2026-9079", "cve_description": "libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them.", "cve_priority": "medium", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9545", "url": "https://ubuntu.com/security/CVE-2026-9545", "cve_description": "In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9080", "url": "https://ubuntu.com/security/CVE-2026-9080", "cve_description": "Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9546", "url": "https://ubuntu.com/security/CVE-2026-9546", "cve_description": "A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" }, { "cve": "CVE-2026-9547", "url": "https://ubuntu.com/security/CVE-2026-9547", "cve_description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.", "cve_priority": "low", "cve_public_date": "2026-07-03 07:16:00 UTC" } ], "log": [ "", " [ Charles Cochran ]", " * SECURITY UPDATE: Authentication bypass in LDAP SASL negotiation.", " - debian/patches/CVE-2026-13608.patch: openldap: handle", " Curl_sasl_continue() returns better in lib/openldap.c.", " - CVE-2026-13608", " * SECURITY UPDATE: Use after free in HTTP/2 server push.", " - debian/patches/CVE-2026-18924.patch: make server push transfers", " inherit share from parent in lib/http2.c.", " - CVE-2026-18924", " * SECURITY UPDATE: Use after free in OpenSSL library context.", " - debian/patches/CVE-2026-80229.patch: avoid conn reuse if provider is", " used in lib/vtls/openssl.c.", " - CVE-2026-80229", " * SECURITY UPDATE: Public key pinning bypass.", " - debian/patches/CVE-2026-80230.patch: require server cert if public", " key pinned in lib/vtls/openssl.c.", " - CVE-2026-80230", " * SECURITY UPDATE: Cookie Secure attribute bypass in Set-Cookie.", " - debian/patches/CVE-2026-80255.patch: improve TAB handling in", " lib/cookie.c, tests/data/Makefile.am, tests/data/test2885.", " - CVE-2026-80255", " * SECURITY UPDATE: Cookie injection for public suffix domains.", " - debian/patches/CVE-2026-82209.patch: ensure cookies set for an exact", " PSL domain are host-only in lib/cookie.c, tests/data/Makefile.am,", " tests/data/test1136, tests/data/test2318, tests/data/test798.", " - CVE-2026-82209", "", " [ Kyle Kernick ]", " * SECURITY UPDATE: Use after free in curl_easy_reset.", " - debian/patches/CVE-2026-10536.patch: Deprecate CURLOPT_* in", " include/curl/curl.h, lib/http2.c,", " lib/setopt.c, lib/url.c, and lib/urldata.h", " - CVE-2026-10536", " * SECURITY UPDATE: Denial of service in QUIC UDP.", " - debian/patches/CVE-2026-11352.patch: Count zero-length UDP packets", " and enforce an upper bound in", " lib/vquic/vquic.c", " - CVE-2026-11352", " * SECURITY UPDATE: Improper certificate validation in native_ca_store.", " - debian/patches/CVE-2026-11564.patch: Add bit native_ca_store_opt to", " keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to", " calculate every easy transfer if a native CA store shall be used or", " not in lib/doh.c, lib/setopt.c, and lib/vtls/vtls.c", " - CVE-2026-11564", " * SECURITY UPDATE: Memory exhaustion in ws.c", " - debian/patches/CVE-2026-11586.patch: Do not send PONG frames unless", " there is sufficient space left in the websocket send buffer in", " lib/ws.c.", " - CVE-2026-11586", " * SECURITY UPDATE: Authentication Bypass by Capture-replay", " - debian/patches/CVE-2026-11856.patch: Flush state on origin or credential", " change in lib/http_digest.c, lib/urldata.h, lib/vauth/digest.c, and", " lib/vauth/digest_sspi.c.", " - CVE-2026-11856", " * SECURITY UPDATE: Improper validation in config2setopts.", " - debian/patches/CVE-2026-12064.patch: Use default protocol properly in", " src/config2setopts.c.", " - CVE-2026-12064", " * SECURITY UPDATE: Connection reuse for starttls protocols.", " - debian/patches/CVE-2026-8286.patch: When a connection is tested for", " reuse in a transfer that may upgrade to TLS (commonly via STARTTLS),", " the SSL configuration must match the existing connection in lib/url.c", " - CVE-2026-8286", " * SECURITY UPDATE: Connection reuse in SASL.", " - debian/patches/CVE-2026-8458.patch: Fix erroneous connection reuse in", " lib/curl_sasl.c, lib/http_negotiate.c, and lib/http_ntlm.c.", " - CVE-2026-8458", " * SECURITY UPDATE: Cookie injection in is_public_suffix.", " - debian/patches/CVE-2026-8924.patch: Trim trailing dots when checking", " PSL in lib/cookie.c.", " - CVE-2026-8924", " * SECURITY UPDATE: Double-free in gsasl.", " - debian/patches/CVE-2026-8925.patch: Require libgsasl 1.6.0 to handle", " NULL argument in lib/vauth/gsasl.c.", " - CVE-2026-8925", " * SECURITY UPDATE: Information disclosure in netrc.", " - debian/patches/CVE-2026-8926.patch: Do not return a password from", " parsenetrc() when the requested login did not match the credentials", " found for the matched machine in lib/netrc.c.", " - CVE-2026-8926", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-8927.patch: Detect if proxy is not the same as", " previous and flush state in lib/url.c and lib/urldata.h.", " - debian/patches/CVE-2026-9079.patch: Verify NULLed proxy credentials", " in lib/setopt.c.", " - debian/patches/CVE-2026-9545.patch: Hard fail when certificate", " verification fails in lib/vquic/curl_ngtcp2.c.", " - CVE-2026-8927", " - CVE-2026-9079", " - CVE-2026-9545", " * SECURITY UPDATE: Use-after-free in curl_easy_pause", " - debian/patches/CVE-2026-9080.patch: Introduce magic struct field to", " assert against NULL pointers in lib/multi_ev.c", " - debian/patches/CVE-2026-9080-post1.patch: Refresh sock entry after", " remove callback in lib/multi_ev.c", " - CVE-2026-9080", " * SECURITY UPDATE: Information disclosure in libcurl", " - debian/patches/CVE-2026-9546.patch: clear referer in lib/transfer.c", " - CVE-2026-9546", " * SECURITY UPDATE: Man-in-the-middle in libcurl.", " - debian/patches/CVE-2026-9547.patch: Reject host key mismatches in", " lib/vssh/libssh.c.", " - CVE-2026-9547", "" ], "package": "curl", "version": "8.20.0-2ubuntu11", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Kyle Kernick ", "date": "Wed, 23 Sep 2026 15:00:22 -0600" }, { "cves": [], "log": [ "", " * Fix typo that inadvertently enabled upki -dev dependency on i386", "" ], "package": "curl", "version": "8.20.0-2ubuntu10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 22 Sep 2026 11:20:58 +0200" }, { "cves": [], "log": [ "", " * REVERT broken 8.20.0-2ubuntu4 SECURITY upload", " - `checksrc` fixes in 8.20.0-2ubuntu7 were ok", " - but CVE 2026-8927 was incorrectly backported and the tests failed", " - see LP #2167779 for more details", " * upki fixes:", " - libcurl4-openssl-dev: depend on libupki-openssl-dev", " - fix #if defined() to ifdef", " - fix old style c issue in autopkgtest checksrc", "" ], "package": "curl", "version": "8.20.0-2ubuntu9", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Sun, 20 Sep 2026 00:08:57 +0200" }, { "cves": [], "log": [ "", " * Include upki integration for OpenSSL build (LP: #2167691),", " excluding s390x (big endian) and i386 (no upki)", " * fix checksrc-warning from cve fix", "" ], "package": "curl", "version": "8.20.0-2ubuntu7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167691 ], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 17:50:35 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libexpat1", "from_version": { "source_package_name": "expat", "source_package_version": "2.8.3-1", "version": "2.8.3-1" }, "to_version": { "source_package_name": "expat", "source_package_version": "2.8.3-1ubuntu1", "version": "2.8.3-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76956", "url": "https://ubuntu.com/security/CVE-2026-76956", "cve_description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66046", "url": "https://ubuntu.com/security/CVE-2026-66046", "cve_description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "cve_priority": "medium", "cve_public_date": "2026-08-18 15:16:00 UTC" }, { "cve": "CVE-2026-76641", "url": "https://ubuntu.com/security/CVE-2026-76641", "cve_description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "cve_priority": "medium", "cve_public_date": "2026-08-20 18:16:00 UTC" }, { "cve": "CVE-2026-76956", "url": "https://ubuntu.com/security/CVE-2026-76956", "cve_description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" }, { "cve": "CVE-2026-76957", "url": "https://ubuntu.com/security/CVE-2026-76957", "cve_description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "cve_priority": "medium", "cve_public_date": "2026-08-20 05:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())", " - debian/patches/CVE-2026-66046-1.patch: lib: Rename hash table", " `defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-66046-2.patch: lib: Migrate .isCdata lookup from a", " linear loop to a hash table lookup in expat/lib/xmlparse.c.", " - CVE-2026-66046", " * SECURITY UPDATE: out-of-bounds read", " - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash", " table entries created by dtdCopy in expat/lib/xmlparse.c,", " expat/tests/basic_tests.c.", " - CVE-2026-76641", " * SECURITY UPDATE: hash flooding vulnerability (possibly causing denial of service)", " - debian/patches/CVE-2026-76956.patch: lib: Fix inverted getentropy() return", " in writeRandomBytes_getentropy in expat/lib/random_getentropy.c.", " - CVE-2026-76956", " * SECURITY UPDATE: use after free", " - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks", " from parser reentry in expat/lib/xmlparse.c.", " - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback", " reentry protection in expat/tests/misc_tests.c.", " - CVE-2026-76957", "" ], "package": "expat", "version": "2.8.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Isabel Garcia Contreras ", "date": "Mon, 21 Sep 2026 15:29:35 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfdisk1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libfreetype6", "from_version": { "source_package_name": "freetype", "source_package_version": "2.14.3+dfsg-2", "version": "2.14.3+dfsg-2" }, "to_version": { "source_package_name": "freetype", "source_package_version": "2.14.3+dfsg-2ubuntu1", "version": "2.14.3+dfsg-2ubuntu1" }, "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-95512", "url": "https://ubuntu.com/security/CVE-2026-95512", "cve_description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "cve_priority": "medium", "cve_public_date": "2026-10-02" } ], "log": [ "", " * SECURITY UPDATE: DoS in CID font loader", " - debian/patches/CVE-2026-95512.patch: * src/cid/cidload.c (cid_read_subrs):", " Limit overlaps. in src/cid/cidload.c.", " - CVE-2026-95512", "" ], "package": "freetype", "version": "2.14.3+dfsg-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 05 Oct 2026 10:40:55 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libgcc-s1", "from_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-2ubuntu1", "version": "16.2.0-2ubuntu1" }, "to_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-3ubuntu1", "version": "16.2.0-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Build from upstream sources.", "" ], "package": "gcc-16", "version": "16.2.0-3ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:36:18 +0200" }, { "cves": [], "log": [ "", " * Update to git 20260918 from the gcc-16 branch.", " - Fix PR target/127306 (RISCV), PR target/127318 (RISCV),", " PR target/127153 (loongarch), PR target/126932 (RISCV),", " PR middle-end/127256, PR target/126463 (AArch64),", " PR target/126196 (RISCV), PR rtl-optimization/125683, PR debug/125421,", " PR target/127188 (RISCV), PR c++/125642, PR c++/127207, PR c++/123495,", " PR c++/126860, PR c++/124983, PR fortran/127128, PR libstdc++/124121,", " PR libstdc++/127220, PR libstdc++/127219, PR libstdc++/126949,", " PR libstdc++/127325, PR libstdc++/126800, PR target/122535 (PPC),", " PR tree-optimization/127390, PR tree-optimization/127377,", " PR tree-optimization/127262, PR tree-optimization/127130,", " PR tree-optimization/127049, PR tree-optimization/127000,", " PR tree-optimization/127000, PR tree-optimization/126760,", " PR tree-optimization/127391, PR tree-optimization/126658, PR ipa/126153,", " PR tree-optimization/126153, PR ipa/126153, PR libstdc++/127430.", " * Strip compiler executables for release builds. Closes: #1147241.", " * Bootstrap using gnat-14, to be able to remove GCC 15.", " * Add comment why libstdc++.so in the gcc_lib_dir needs to be copy", " of the library, not a symlink.", " * Apply PR target/120165 (m68k only), taken from the trunk.", "" ], "package": "gcc-16", "version": "16.2.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:35:21 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libjs-sphinxdoc", "from_version": { "source_package_name": "sphinx", "source_package_version": "9.1.0-6", "version": "9.1.0-6" }, "to_version": { "source_package_name": "sphinx", "source_package_version": "9.1.0-8", "version": "9.1.0-8" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Alexandre Detiste ]", " * Drop python3-setuptools from debian/tests/control.", " * Drop build-dependency on python3-html5lib.", "", " [ Dmitry Shachnev ]", " * Add a patch to fix test failure in test_cfunction (closes: #1147737).", "" ], "package": "sphinx", "version": "9.1.0-8", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Dmitry Shachnev ", "date": "Tue, 15 Sep 2026 14:39:13 +0300" }, { "cves": [], "log": [ "", " * Team upload.", " * Drop build-dependency on python3-setuptools", "" ], "package": "sphinx", "version": "9.1.0-7", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Thu, 27 Aug 2026 18:15:50 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "liblastlog2-2", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libmount1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnetplan1", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-1", "version": "1.2.2-1" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-3", "version": "1.2.2-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Grayson Wolf ]", " * d/p/lp2168838-ovs-test.patch: Fix autopkgtests on ovs 4 (Closes: #1149299)", "" ], "package": "netplan.io", "version": "1.2.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Wed, 30 Sep 2026 20:59:16 +0200" }, { "cves": [], "log": [ "", " * d/t/prep-testbed: Remove LXC quirks (Closes: #1144818)", " which are not needed for incus-lxc anymore.", "" ], "package": "netplan.io", "version": "1.2.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Thu, 27 Aug 2026 18:12:25 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnpth0t64", "from_version": { "source_package_name": "npth", "source_package_version": "1.8-3build1", "version": "1.8-3build1" }, "to_version": { "source_package_name": "npth", "source_package_version": "1.8-4", "version": "1.8-4" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Fix lintian overrides", " * Convert watch file to v5", " * Remove redundant Priority: optional from source stanza.", " * Upgrade upstream signing key to new packet format.", " * Removed Rules-Requires-Root", " * Add upstream/metadata pointing at the git repos", "" ], "package": "npth", "version": "1.8-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Eric Dorland ", "date": "Tue, 15 Sep 2026 14:29:56 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libnss-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libopeniscsiusr", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.11-5ubuntu5", "version": "2.1.11-5ubuntu5" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.11-5ubuntu6", "version": "2.1.11-5ubuntu6" }, "cves": [], "launchpad_bugs_fixed": [ 2167074 ], "changes": [ { "cves": [], "log": [ "", " * d/t/{testlib.py,test-open-iscsi.py}: improve codename detection", " to not relay on /etc/lsb-release that has been removed in base-files", " (LP: #2167074)", " In addition to this fix, various misc fixes are added:", " + fix e.return_code.", " + remove unused dep on python3-netifaces.", " + add depends on lsb-release since it is required/checked by", " testlib.py: TestlibManager.", " + d/t/control: transition dep from ubuntu-cloudimg-keyring", " to ubuntu-keyring.", " + d/t/control: allow stderr for install test.", " + d/t/test-open-iscsi.py: disable the cloud image test since it is", " failing with dracut because of the test setup itself.", " This is a fix for existing delta:", " debian/tests: Add Ubuntu autopkgtest suite", "" ], "package": "open-iscsi", "version": "2.1.11-5ubuntu6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167074 ], "author": "Hector Cao ", "date": "Tue, 15 Sep 2026 16:25:06 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpam-systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libparted2t64", "from_version": { "source_package_name": "parted", "source_package_version": "3.7-1", "version": "3.7-1" }, "to_version": { "source_package_name": "parted", "source_package_version": "3.8-2", "version": "3.8-2" }, "cves": [ { "cve": "CVE-2026-89085", "url": "https://ubuntu.com/security/CVE-2026-89085", "cve_description": "[heap buffer overflow in _init_fats / fat_table_read]", "cve_priority": "medium", "cve_public_date": "2026-09-17" }, { "cve": "CVE-2026-89088", "url": "https://ubuntu.com/security/CVE-2026-89088", "cve_description": "[heap buffer overflow in duplicate_legacy_root_dir]", "cve_priority": "medium", "cve_public_date": "2026-09-17" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Reupload pointing dgit to the correct upstream tag.", "" ], "package": "parted", "version": "3.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 25 Sep 2026 10:10:23 +0100" }, { "cves": [ { "cve": "CVE-2026-89085", "url": "https://ubuntu.com/security/CVE-2026-89085", "cve_description": "[heap buffer overflow in _init_fats / fat_table_read]", "cve_priority": "medium", "cve_public_date": "2026-09-17" }, { "cve": "CVE-2026-89088", "url": "https://ubuntu.com/security/CVE-2026-89088", "cve_description": "[heap buffer overflow in duplicate_legacy_root_dir]", "cve_priority": "medium", "cve_public_date": "2026-09-17" } ], "log": [ "", " * New upstream release:", " - CVE-2026-89085, CVE-2026-89088: Catch errors triggered by bad FAT", " metadata (closes: #1148169).", "" ], "package": "parted", "version": "3.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 25 Sep 2026 09:31:05 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpcap0.8t64", "from_version": { "source_package_name": "libpcap", "source_package_version": "1.10.6-2ubuntu1", "version": "1.10.6-2ubuntu1" }, "to_version": { "source_package_name": "libpcap", "source_package_version": "1.10.7-1ubuntu1", "version": "1.10.7-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-0799", "url": "https://ubuntu.com/security/CVE-2026-0799", "cve_description": "In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-31912", "url": "https://ubuntu.com/security/CVE-2026-31912", "cve_description": "libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-31911", "url": "https://ubuntu.com/security/CVE-2026-31911", "cve_description": "libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-6244", "url": "https://ubuntu.com/security/CVE-2026-6244", "cve_description": "libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-6554", "url": "https://ubuntu.com/security/CVE-2026-6554", "cve_description": "libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-18313", "url": "https://ubuntu.com/security/CVE-2026-18313", "cve_description": "rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-18238", "url": "https://ubuntu.com/security/CVE-2026-18238", "cve_description": "The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge from Debian unstable. Remaining changes:", " - Add Build-Depends on libibverbs-dev to enable RDMA support.", " LP #2006557.", " - Have -dev package depend on libibverbs-dev per pkgconfig", " - Don't require libverbs on i386", "" ], "package": "libpcap", "version": "1.10.7-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Fri, 18 Sep 2026 19:02:40 +0200" }, { "cves": [ { "cve": "CVE-2026-0799", "url": "https://ubuntu.com/security/CVE-2026-0799", "cve_description": "In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-31912", "url": "https://ubuntu.com/security/CVE-2026-31912", "cve_description": "libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-31911", "url": "https://ubuntu.com/security/CVE-2026-31911", "cve_description": "libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-6244", "url": "https://ubuntu.com/security/CVE-2026-6244", "cve_description": "libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-6554", "url": "https://ubuntu.com/security/CVE-2026-6554", "cve_description": "libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-18313", "url": "https://ubuntu.com/security/CVE-2026-18313", "cve_description": "rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" }, { "cve": "CVE-2026-18238", "url": "https://ubuntu.com/security/CVE-2026-18238", "cve_description": "The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.", "cve_priority": "medium", "cve_public_date": "2026-09-05 19:16:00 UTC" } ], "log": [ "", " * Team upload.", "", " [ Gianfranco Costamagna ]", " * Edit changelog, drop extra newlines", "", " [ Sven Geuer ]", " * New upstream version 1.10.7 (Closes: #1146825)", " - CVE-2026-0799: Access M[] safely in the BPF interpreter.", " - CVE-2026-31912: Mind the program bounds in pcap_offline_filter().", " - CVE-2026-31911: Fail opcodes safely in the BPF interpreter.", " - CVE-2026-6244: Avoid division by zero via pcap_offline_filter().", " - CVE-2026-6554: Limit \"ja L\" looping in pcap_offline_filter().", " - CVE-2026-18313: Fix a memory leak in rpcapd.", " - CVE-2026-18238: Fix RPCAP_MSG_PACKET validation.", "" ], "package": "libpcap", "version": "1.10.7-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sven Geuer ", "date": "Tue, 08 Sep 2026 15:56:57 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpng16-16t64", "from_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.58-1", "version": "1.6.58-1" }, "to_version": { "source_package_name": "libpng1.6", "source_package_version": "1.6.59-1", "version": "1.6.59-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * New upstream version 1.6.59", "" ], "package": "libpng1.6", "version": "1.6.59-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Gianfranco Costamagna ", "date": "Fri, 02 Oct 2026 08:04:23 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14-minimal", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libpython3.14-stdlib", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libselinux1", "from_version": { "source_package_name": "libselinux", "source_package_version": "3.11-2", "version": "3.11-2" }, "to_version": { "source_package_name": "libselinux", "source_package_version": "3.11-2.1", "version": "3.11-2.1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Non-maintainer upload.", "", " [ Maximiliano Curia ]", " * Fix ftbfs with swig 4.5.0. Closes: #1145457.", "" ], "package": "libselinux", "version": "3.11-2.1", "urgency": "medium", "distributions": "sid", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 24 Sep 2026 15:37:09 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsmartcols1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "libssh2-1t64", "from_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-4ubuntu3", "version": "1.11.1-4ubuntu3" }, "to_version": { "source_package_name": "libssh2", "source_package_version": "1.11.1-6", "version": "1.11.1-6" }, "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-5805", "url": "https://ubuntu.com/security/CVE-2026-5805", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-58051", "url": "https://ubuntu.com/security/CVE-2026-58051", "cve_description": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" }, { "cve": "CVE-2026-58050", "url": "https://ubuntu.com/security/CVE-2026-58050", "cve_description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-66032", "url": "https://ubuntu.com/security/CVE-2026-66032", "cve_description": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66033", "url": "https://ubuntu.com/security/CVE-2026-66033", "cve_description": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by negotiating AES-GCM ciphers during handshake. Attackers can exploit the underflow in the expression computing blocksize minus aadlen minus authentication tag length to trigger an out-of-bounds read and a memcpy call with a near-SIZE_MAX length argument, causing immediate process crash before any authentication occurs.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" }, { "cve": "CVE-2026-66035", "url": "https://ubuntu.com/security/CVE-2026-66035", "cve_description": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length smaller than the cipher's block size during Encrypt-then-MAC cipher negotiation. In the fullpacket() function in src/transport.c, the ETM path allocates a buffer of packet_length bytes but copies blocksize minus one bytes via memcpy, causing an overflow that on 32-bit glibc writes attacker-controlled bytes into an adjacent chunk's SIZE field, enabling tcache bin confusion, overlapping live objects, and function pointer overwrite during the session handshake before authentication.", "cve_priority": "medium", "cve_public_date": "2026-07-24 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: double-free vulnerability in sftp_open()", " - debian/patches/CVE-2026-66032.patch: Prevent dangling pointer by", " nullifying data in src/sftp.c.", " - CVE-2026-66032", " * SECURITY UPDATE: pre-authentication integer underflow vulnerability", " - debian/patches/CVE-2026-66033.patch: fix potential OOB read/write with", " AES-GCM in `ssh2_cipher_crypt()` in src/openssl.c.", " - CVE-2026-66033", " * SECURITY UPDATE: pre-authentication heap buffer overflow vulnerability", " - debian/patches/CVE-2026-66035.patch: transport: fix potential heap", " overflow on ETM decrypt in src/transport.c.", " - CVE-2026-66035", "" ], "package": "libssh2", "version": "1.11.1-4ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Wed, 02 Sep 2026 07:45:31 -0400" }, { "cves": [], "log": [ "", " * No-change rebuild against libssl4", "" ], "package": "libssh2", "version": "1.11.1-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Ravi Kant Sharma ", "date": "Fri, 24 Jul 2026 07:50:24 +0000" }, { "cves": [ { "cve": "CVE-2026-5805", "url": "https://ubuntu.com/security/CVE-2026-5805", "cve_description": "", "cve_priority": "n/a", "cve_public_date": "" }, { "cve": "CVE-2026-58051", "url": "https://ubuntu.com/security/CVE-2026-58051", "cve_description": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" }, { "cve": "CVE-2026-58050", "url": "https://ubuntu.com/security/CVE-2026-58050", "cve_description": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", "cve_priority": "medium", "cve_public_date": "2026-06-28 02:16:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Multiple security issues in publickey", " - debian/patches/CVE-2026-5805x-pre1.patch: fix potential arbitrary free", " in libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre2.patch: fix potential multiplication", " overflow in 32-bit libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre3.patch: cap packet size in", " publickey_packet_receive().", " - debian/patches/CVE-2026-5805x-pre4.patch: fix leaks when", " publickey_response_success() received <8 bytes.", " - debian/patches/CVE-2026-5805x-pre5.patch: fix potential OOB read in", " publickey_response_success().", " - debian/patches/CVE-2026-58051.patch: fix potential OOB read in", " libssh2_publickey_list_fetch().", " - debian/patches/CVE-2026-5805x-pre6.patch: fix potential OOB read.", " - debian/patches/CVE-2026-5805x-pre7.patch: flatten bounds check if blocks", " (tidy-up).", " - debian/patches/CVE-2026-5805x-pre8.patch: rework bounds checks to avoid", " pointer comparisons.", " - debian/patches/CVE-2026-58050.patch: cap variable-length packet element", " sizes.", " - CVE-2026-58050", " - CVE-2026-58051", "" ], "package": "libssh2", "version": "1.11.1-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Tue, 07 Jul 2026 14:23:05 -0400" } ], "notes": null, "is_version_downgrade": true }, { "name": "libssl4", "from_version": { "source_package_name": "openssl", "source_package_version": "4.0.1-1ubuntu4", "version": "4.0.1-1ubuntu4" }, "to_version": { "source_package_name": "openssl", "source_package_version": "4.0.3-1ubuntu1", "version": "4.0.3-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167826 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian experimental (LP: #2167826). Remaining changes:", " - Use perl:native in the autopkgtest for installability on i386.", " - Symlink copyright/changelog.Debian.gz in libssl3* to libssl-dev/openssl", " - Disable LTO with which the codebase is generally incompatible", " (LP #2058017)", " - Default config reads crypto-config and /etc/ssl/openssl.cnf.d dropins", " - Don't enable or package anything FIPS (LP #2087955)", " - Match last filename for output in ecp_nistp521-ppc64.pl (LP #2137464)", " - Enable CPU jitter fluctuations", " - fips patches (debian/patches/fips):", " - crypto: Add kernel FIPS mode detection", " - crypto: Automatically use the FIPS provider...", " - apps/speed: Omit unavailable algorithms in FIPS mode", " - apps: pass -propquery arg to the libctx DRBG fetches", " - test: Ensure encoding runs with the correct context...", " - Add Ubuntu-specific defines to help FIPS certification (LP #2073991)", " + UBUNTU_OSSL_SELF_TEST_DESC_PCT_DH", " + UBUNTU_OSSL_PROV_FIPS_PARAM_UNAPPROVED_USAGE", " - Detect FIPS jitterentropy mode and load jitterentropy enabled FIPS", " provider", " - Fallback to default provider when FIPS provider is missing.", "" ], "package": "openssl", "version": "4.0.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167826 ], "author": "Ravi Kant Sharma ", "date": "Fri, 02 Oct 2026 12:25:40 +0200" }, { "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * Import 4.0.3", " - CVE-2026-84782 (\"DTLS Retransmits Handshake Messages From a Stale Buffer", " Offset\")", " - CVE-2026-35189 (\"Memory Allocation in Relative CRLDP Processing\")", " - CVE-2026-35191 (\"QUIC Unvalidated Amplification Credit may be Over", " Accounted\")", " - CVE-2026-42772 (\"Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC\")", " - CVE-2026-54872 (\"Timing Side-Channel in Scalar Multiplication for Non-NIST", " EC Curves\")", " - CVE-2026-54873 (\"QUIC STREAM Fragment Metadata DoS\")", " - CVE-2026-54875 (\"Non-Constant-Time SM2 Scalar Multiplication on ARM64 and", " RISC-V\")", " - CVE-2026-72897 (\"Out-of-Bounds Access After SSL_set_SSL_CTX() During a", " Handshake\")", " - CVE-2026-75804 (\"QUIC Connection-Level Flow Control is Not Enforced for", " Streams\")", " - CVE-2026-75805 (\"NULL Pointer Dereference in CMP Client Revocation", " Response Handling\")", " - CVE-2026-75806 (\"Unauthenticated and Undersized DTLS 1.2 AEAD Record", " Causes DoS\")", " - CVE-2026-77696 (\"Timing Side-Channel in SM2 Signature Generation\")", " - CVE-2026-84783 (\"Use-After-Free in X.509 Extension Cache Under Concurrent Use\")", " - CVE-2026-84784 (\"QUIC: Unbounded RETIRE_CONNECTION_ID Backlog\")", "" ], "package": "openssl", "version": "4.0.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 29 Sep 2026 21:40:01 +0200" }, { "cves": [ { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "log": [ "", " * Import 4.0.2", " - CVE-2026-18798 (\"QUIC Server May Trigger Double Free When Processing", " INITIAL Packet\")", " - CVE-2026-63072 (\"Heap Buffer Overflow in CMS Key Unwrapping\")", " - CVE-2026-63076 (\"Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg\")", " - CVE-2026-14457 (\"RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate\")", " - CVE-2026-54874 (\"Excessive Memory Use Buffering DTLS Records for a Future", " Epoch\")", " - CVE-2026-63073 (\"Untrusted Sender DN Used as Format String in CMP Response", " Validation\")", " - CVE-2026-63074 (\"CMP Indefinite Cache Growth of ExtraCerts\")", " - CVE-2026-63075 (\"QUIC ACK-only Packet Retention Can Cause Memory", " Exhaustion\")", " - CVE-2026-75803 (\"AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()\") (Closes: #1145172)", " - CVE-2026-14456 (\"Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue\") (Closes: #1144615)", " - CVE-2026-54876 (\"Client-Side Memory Leak in OCSP Response Checking\") (Closes: #1143841)", "" ], "package": "openssl", "version": "4.0.2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 25 Aug 2026 21:19:42 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libstdc++6", "from_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-2ubuntu1", "version": "16.2.0-2ubuntu1" }, "to_version": { "source_package_name": "gcc-16", "source_package_version": "16.2.0-3ubuntu1", "version": "16.2.0-3ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Build from upstream sources.", "" ], "package": "gcc-16", "version": "16.2.0-3ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:36:18 +0200" }, { "cves": [], "log": [ "", " * Update to git 20260918 from the gcc-16 branch.", " - Fix PR target/127306 (RISCV), PR target/127318 (RISCV),", " PR target/127153 (loongarch), PR target/126932 (RISCV),", " PR middle-end/127256, PR target/126463 (AArch64),", " PR target/126196 (RISCV), PR rtl-optimization/125683, PR debug/125421,", " PR target/127188 (RISCV), PR c++/125642, PR c++/127207, PR c++/123495,", " PR c++/126860, PR c++/124983, PR fortran/127128, PR libstdc++/124121,", " PR libstdc++/127220, PR libstdc++/127219, PR libstdc++/126949,", " PR libstdc++/127325, PR libstdc++/126800, PR target/122535 (PPC),", " PR tree-optimization/127390, PR tree-optimization/127377,", " PR tree-optimization/127262, PR tree-optimization/127130,", " PR tree-optimization/127049, PR tree-optimization/127000,", " PR tree-optimization/127000, PR tree-optimization/126760,", " PR tree-optimization/127391, PR tree-optimization/126658, PR ipa/126153,", " PR tree-optimization/126153, PR ipa/126153, PR libstdc++/127430.", " * Strip compiler executables for release builds. Closes: #1147241.", " * Bootstrap using gnat-14, to be able to remove GCC 15.", " * Add comment why libstdc++.so in the gcc_lib_dir needs to be copy", " of the library, not a symlink.", " * Apply PR target/120165 (m68k only), taken from the trunk.", "" ], "package": "gcc-16", "version": "16.2.0-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Fri, 18 Sep 2026 09:35:21 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd-shared", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libsystemd0", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libudev1", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libuuid1", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-generic", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-5.5+3", "version": "7.3.0-5.5+3" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168012 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependencies for v4l2loopback", "" ], "package": "linux-meta", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168012 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:08:40 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "" ], "package": "linux-meta", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:13:36 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "" ], "package": "linux-meta", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:03 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-5.5+3", "version": "7.3.0-5.5+3" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168012 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependencies for v4l2loopback", "" ], "package": "linux-meta", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168012 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:08:40 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "" ], "package": "linux-meta", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:13:36 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "" ], "package": "linux-meta", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:03 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-5.5+3", "version": "7.3.0-5.5+3" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168012 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependencies for v4l2loopback", "" ], "package": "linux-meta", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168012 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:08:40 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "" ], "package": "linux-meta", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:13:36 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "" ], "package": "linux-meta", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:03 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-perf", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-common", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "linux-virtual", "from_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-5.5+3", "version": "7.3.0-5.5+3" }, "to_version": { "source_package_name": "linux-meta", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168012 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependencies for v4l2loopback", "" ], "package": "linux-meta", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168012 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:08:40 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "" ], "package": "linux-meta", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:13:36 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "" ], "package": "linux-meta", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:03 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "login", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "1:4.16.0-2+really2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "1:4.16.0-2+really2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "login.defs", "from_version": { "source_package_name": "shadow", "source_package_version": "1:4.19.3-2ubuntu1", "version": "1:4.19.3-2ubuntu1" }, "to_version": { "source_package_name": "shadow", "source_package_version": "1:4.19.3-2ubuntu2", "version": "1:4.19.3-2ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No change rebuild with debhelper 14.5ubuntu1 to drop dependency from", " passwd to systemd.", "" ], "package": "shadow", "version": "1:4.19.3-2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Michael Hudson-Doyle ", "date": "Wed, 23 Sep 2026 10:13:29 +1200" } ], "notes": null, "is_version_downgrade": false }, { "name": "mount", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan-generator", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-1", "version": "1.2.2-1" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-3", "version": "1.2.2-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Grayson Wolf ]", " * d/p/lp2168838-ovs-test.patch: Fix autopkgtests on ovs 4 (Closes: #1149299)", "" ], "package": "netplan.io", "version": "1.2.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Wed, 30 Sep 2026 20:59:16 +0200" }, { "cves": [], "log": [ "", " * d/t/prep-testbed: Remove LXC quirks (Closes: #1144818)", " which are not needed for incus-lxc anymore.", "" ], "package": "netplan.io", "version": "1.2.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Thu, 27 Aug 2026 18:12:25 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "netplan.io", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-1", "version": "1.2.2-1" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-3", "version": "1.2.2-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Grayson Wolf ]", " * d/p/lp2168838-ovs-test.patch: Fix autopkgtests on ovs 4 (Closes: #1149299)", "" ], "package": "netplan.io", "version": "1.2.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Wed, 30 Sep 2026 20:59:16 +0200" }, { "cves": [], "log": [ "", " * d/t/prep-testbed: Remove LXC quirks (Closes: #1144818)", " which are not needed for incus-lxc anymore.", "" ], "package": "netplan.io", "version": "1.2.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Thu, 27 Aug 2026 18:12:25 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "open-iscsi", "from_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.11-5ubuntu5", "version": "2.1.11-5ubuntu5" }, "to_version": { "source_package_name": "open-iscsi", "source_package_version": "2.1.11-5ubuntu6", "version": "2.1.11-5ubuntu6" }, "cves": [], "launchpad_bugs_fixed": [ 2167074 ], "changes": [ { "cves": [], "log": [ "", " * d/t/{testlib.py,test-open-iscsi.py}: improve codename detection", " to not relay on /etc/lsb-release that has been removed in base-files", " (LP: #2167074)", " In addition to this fix, various misc fixes are added:", " + fix e.return_code.", " + remove unused dep on python3-netifaces.", " + add depends on lsb-release since it is required/checked by", " testlib.py: TestlibManager.", " + d/t/control: transition dep from ubuntu-cloudimg-keyring", " to ubuntu-keyring.", " + d/t/control: allow stderr for install test.", " + d/t/test-open-iscsi.py: disable the cloud image test since it is", " failing with dracut because of the test setup itself.", " This is a fix for existing delta:", " debian/tests: Add Ubuntu autopkgtest suite", "" ], "package": "open-iscsi", "version": "2.1.11-5ubuntu6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167074 ], "author": "Hector Cao ", "date": "Tue, 15 Sep 2026 16:25:06 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl", "from_version": { "source_package_name": "openssl", "source_package_version": "4.0.1-1ubuntu4", "version": "4.0.1-1ubuntu4" }, "to_version": { "source_package_name": "openssl", "source_package_version": "4.0.3-1ubuntu1", "version": "4.0.3-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167826 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian experimental (LP: #2167826). Remaining changes:", " - Use perl:native in the autopkgtest for installability on i386.", " - Symlink copyright/changelog.Debian.gz in libssl3* to libssl-dev/openssl", " - Disable LTO with which the codebase is generally incompatible", " (LP #2058017)", " - Default config reads crypto-config and /etc/ssl/openssl.cnf.d dropins", " - Don't enable or package anything FIPS (LP #2087955)", " - Match last filename for output in ecp_nistp521-ppc64.pl (LP #2137464)", " - Enable CPU jitter fluctuations", " - fips patches (debian/patches/fips):", " - crypto: Add kernel FIPS mode detection", " - crypto: Automatically use the FIPS provider...", " - apps/speed: Omit unavailable algorithms in FIPS mode", " - apps: pass -propquery arg to the libctx DRBG fetches", " - test: Ensure encoding runs with the correct context...", " - Add Ubuntu-specific defines to help FIPS certification (LP #2073991)", " + UBUNTU_OSSL_SELF_TEST_DESC_PCT_DH", " + UBUNTU_OSSL_PROV_FIPS_PARAM_UNAPPROVED_USAGE", " - Detect FIPS jitterentropy mode and load jitterentropy enabled FIPS", " provider", " - Fallback to default provider when FIPS provider is missing.", "" ], "package": "openssl", "version": "4.0.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167826 ], "author": "Ravi Kant Sharma ", "date": "Fri, 02 Oct 2026 12:25:40 +0200" }, { "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * Import 4.0.3", " - CVE-2026-84782 (\"DTLS Retransmits Handshake Messages From a Stale Buffer", " Offset\")", " - CVE-2026-35189 (\"Memory Allocation in Relative CRLDP Processing\")", " - CVE-2026-35191 (\"QUIC Unvalidated Amplification Credit may be Over", " Accounted\")", " - CVE-2026-42772 (\"Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC\")", " - CVE-2026-54872 (\"Timing Side-Channel in Scalar Multiplication for Non-NIST", " EC Curves\")", " - CVE-2026-54873 (\"QUIC STREAM Fragment Metadata DoS\")", " - CVE-2026-54875 (\"Non-Constant-Time SM2 Scalar Multiplication on ARM64 and", " RISC-V\")", " - CVE-2026-72897 (\"Out-of-Bounds Access After SSL_set_SSL_CTX() During a", " Handshake\")", " - CVE-2026-75804 (\"QUIC Connection-Level Flow Control is Not Enforced for", " Streams\")", " - CVE-2026-75805 (\"NULL Pointer Dereference in CMP Client Revocation", " Response Handling\")", " - CVE-2026-75806 (\"Unauthenticated and Undersized DTLS 1.2 AEAD Record", " Causes DoS\")", " - CVE-2026-77696 (\"Timing Side-Channel in SM2 Signature Generation\")", " - CVE-2026-84783 (\"Use-After-Free in X.509 Extension Cache Under Concurrent Use\")", " - CVE-2026-84784 (\"QUIC: Unbounded RETIRE_CONNECTION_ID Backlog\")", "" ], "package": "openssl", "version": "4.0.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 29 Sep 2026 21:40:01 +0200" }, { "cves": [ { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "log": [ "", " * Import 4.0.2", " - CVE-2026-18798 (\"QUIC Server May Trigger Double Free When Processing", " INITIAL Packet\")", " - CVE-2026-63072 (\"Heap Buffer Overflow in CMS Key Unwrapping\")", " - CVE-2026-63076 (\"Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg\")", " - CVE-2026-14457 (\"RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate\")", " - CVE-2026-54874 (\"Excessive Memory Use Buffering DTLS Records for a Future", " Epoch\")", " - CVE-2026-63073 (\"Untrusted Sender DN Used as Format String in CMP Response", " Validation\")", " - CVE-2026-63074 (\"CMP Indefinite Cache Growth of ExtraCerts\")", " - CVE-2026-63075 (\"QUIC ACK-only Packet Retention Can Cause Memory", " Exhaustion\")", " - CVE-2026-75803 (\"AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()\") (Closes: #1145172)", " - CVE-2026-14456 (\"Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue\") (Closes: #1144615)", " - CVE-2026-54876 (\"Client-Side Memory Leak in OCSP Response Checking\") (Closes: #1143841)", "" ], "package": "openssl", "version": "4.0.2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 25 Aug 2026 21:19:42 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "openssl-provider-legacy", "from_version": { "source_package_name": "openssl", "source_package_version": "4.0.1-1ubuntu4", "version": "4.0.1-1ubuntu4" }, "to_version": { "source_package_name": "openssl", "source_package_version": "4.0.3-1ubuntu1", "version": "4.0.3-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "launchpad_bugs_fixed": [ 2167826 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian experimental (LP: #2167826). Remaining changes:", " - Use perl:native in the autopkgtest for installability on i386.", " - Symlink copyright/changelog.Debian.gz in libssl3* to libssl-dev/openssl", " - Disable LTO with which the codebase is generally incompatible", " (LP #2058017)", " - Default config reads crypto-config and /etc/ssl/openssl.cnf.d dropins", " - Don't enable or package anything FIPS (LP #2087955)", " - Match last filename for output in ecp_nistp521-ppc64.pl (LP #2137464)", " - Enable CPU jitter fluctuations", " - fips patches (debian/patches/fips):", " - crypto: Add kernel FIPS mode detection", " - crypto: Automatically use the FIPS provider...", " - apps/speed: Omit unavailable algorithms in FIPS mode", " - apps: pass -propquery arg to the libctx DRBG fetches", " - test: Ensure encoding runs with the correct context...", " - Add Ubuntu-specific defines to help FIPS certification (LP #2073991)", " + UBUNTU_OSSL_SELF_TEST_DESC_PCT_DH", " + UBUNTU_OSSL_PROV_FIPS_PARAM_UNAPPROVED_USAGE", " - Detect FIPS jitterentropy mode and load jitterentropy enabled FIPS", " provider", " - Fallback to default provider when FIPS provider is missing.", "" ], "package": "openssl", "version": "4.0.3-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167826 ], "author": "Ravi Kant Sharma ", "date": "Fri, 02 Oct 2026 12:25:40 +0200" }, { "cves": [ { "cve": "CVE-2026-84782", "url": "https://ubuntu.com/security/CVE-2026-84782", "cve_description": "Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "high", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35189", "url": "https://ubuntu.com/security/CVE-2026-35189", "cve_description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix postpones processing of the CRL distribution points extensions in certificates to the time when the processed value is required for CRL processing. This avoids keeping large memory allocations for a long time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-35191", "url": "https://ubuntu.com/security/CVE-2026-35191", "cve_description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-42772", "url": "https://ubuntu.com/security/CVE-2026-42772", "cve_description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC peer that completes the handshake can create a connection-scoped CPU pressure and potentially a Denial of Service using compliant STREAM frames inside the advertised receive window, with low attacker bandwidth. CWE: CWE-407: Inefficient Algorithmic Complexity Description: OpenSSL manages received QUIC stream fragments using a doubly-linked list. While it optimizes for append operations (at the end of the list), it falls back to a head-to-tail linear search for any fragment that does not immediately follow the current `tail`. By manipulating the sequence of offsets, an attacker can force the server to perform O(n^2) operations, consuming excessive CPU time for the QUIC process. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54872", "url": "https://ubuntu.com/security/CVE-2026-54872", "cve_description": "Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to measure signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very small; observing it requires a large number of measurements. The effect is largest for curves whose group order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use the affected code path.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54873", "url": "https://ubuntu.com/security/CVE-2026-54873", "cve_description": "Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the local QUIC stack to keep the memory for packet buffers allocated. The time for which the memory remains allocated is entirely under the control of the potentially malicious remote peer. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: To save copy operation from the packet buffer to the stream reassemble buffer the QUIC stack leaves the stream data on the packet buffer waiting to be copied to a buffer provided by the local receiving application. The QUIC stack releases a reference to the packet buffer only after the data are copied to the application buffer. This design is more efficient for legitimate data transfers but enables an attacker to allocate a lot more memory than actually required by the data kept in the receiving stream buffer. To mitigate the vulnerability, the QUIC stack now calculates and monitors memory overhead for every stream. The memory overhead for a single stream frame is calculated as a difference between the size of the whole packet that carries the stream frame and the size of the stream frame itself. The memory overhead for a single stream frame is added to the total (cumulative) memory overhead QUIC stack keeps for each stream. Once the cumulative memory overhead exceeds 64kB, the QUIC stack moves the stream frame data from the packet buffer to the stream buffer, starting with the next packet received. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-54875", "url": "https://ubuntu.com/security/CVE-2026-54875", "cve_description": "Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access pattern of SM2 signing or decryption on an affected platform can learn information about the secret scalar. CWE: CWE-208: Observable Timing Discrepancy Description: On ARM64 and RISC-V processors, the SM2 curve uses an optimized scalar multiplication implementation whose conditional branches and table look ups are chosen according to the bits of the secret scalar. The execution time and the cache-access pattern therefore depend on the long-term private key (during SM2 decryption) or the per-signature nonce (during SM2 signature generation), forming a timing and cache side-channel. FIPS Impact: no SM2 is not a FIPS algorithm and the optimized SM2 implementation is not part of the FIPS module. OpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and RISC-V. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.5. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.9. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.8. This issue was reported on 2 May 2026 by Abhinav Agarwal. It was independently reported on 6 June 2026 by Feng Xue. The fix was developed by Igor Ustinov. -- cut (non-publishing metadata for internal use) -- Reported by: Abhinav Agarwal, Feng Xue Fixed by: Igor Ustinov", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-72897", "url": "https://ubuntu.com/security/CVE-2026-72897", "cve_description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. Applications which never call SSL_set_SSL_CTX() are not affected. Impact summary: A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap. This may lead to a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: A TLS connection records how many certificate slots it has when it is created, taken from the SSL_CTX that created it: the built-in certificate types plus one slot for each provider TLS-SIGALG entry that context was aware of. That count sizes an internal array of per-slot certificate validity flags. An application may replace a connection's SSL_CTX part way through the handshake by calling SSL_set_SSL_CTX(), most commonly from a servername callback in order to serve a different virtual host. Doing so did not refresh the recorded count. A provider signature algorithm's slot index is its position in the list of whichever context resolves it, so if the replacement context is aware of more of them than the original, an algorithm offered by the peer can resolve to an index beyond the end of the array. Processing the peer's signature algorithms then reads one four byte word past the end for each such algorithm and, where the word read is zero, writes a fixed value over it. A peer offering many of them can corrupt heap metadata and abort the process. Only provider signature algorithms which occupy one of the excess slots, and which the server also has configured, have this effect. Codepoints the replacement context does not recognise are discarded without being resolved to a slot, and provider signature algorithms are usable only from TLS 1.3. The two contexts must therefore be aware of different numbers of provider signature algorithms, which requires separate library contexts, a provider loaded between the two being created, or providers which differ in what they advertise - in 4.0, for example, the default provider advertises SM2 where the FIPS provider does not. A deployment meeting the condition is also unable to negotiate the affected algorithms with legitimate clients, since the same stale count hides the corresponding certificates, so the misconfiguration is likely to be noticed. For that reason, and because the configuration is not the default, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75804", "url": "https://ubuntu.com/security/CVE-2026-75804", "cve_description": "Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the QUIC stack receive ~100MB of memory instead of 768 KiB (default flow control window size). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The local QUIC stack advertises two flow control limits to its remote peer: stream flow control limit and connection flow control limit. The remote peer must follow both limits when transmitting stream data. Whenever the local QUIC stack receives a stream frame, it validates that the size of the received stream frame stays within flow control limits. If either limit is exceeded (stream level or connection level), then the QUIC stack must close the connection with a flow control error. The vulnerable OpenSSL QUIC stack enforces the stream-level but not the connection-level limit. To exploit the issue, three conditions must be met: - the remote peer opens several streams - each stream must stay within the stream-level flow control limit - there must be no zero-offset byte sent on any of the streams (to prevent the vulnerable QUIC stack from consuming data). By meeting the conditions above, the remote peer may make the local stack allocate 2 x MAX_STREAMS x (stream flow control limit) bytes of memory. MAX_STREAMS defaults to 100, and the limit applies to both bidirectional and unidirectional streams, making it 200 in total. The default flow control window for a stream is 512kB. The remote peer may force the vulnerable QUIC stack to allocate 100MB of heap per connection. FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75805", "url": "https://ubuntu.com/security/CVE-2026-75805", "cve_description": "Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when processing a crafted revocation response. Impact summary: The NULL pointer dereference happens on a read which leads to a crash and a Denial of Service for the affected client application. CWE: CWE-476: NULL-pointer dereference Description: A CMP client revoking a certificate has to tell the server which certificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the certificate itself or its issuer name and serial number. This is 'openssl cmp -cmd rr -csr ' on the command line, or OSSL_CMP_exec_RR_ses() with the certificate supplied via OSSL_CMP_CTX_set1_p10CSR() through the API. A CSR does not contain the issuer name and serial number of the certificate, so the client does not send them. A server may optionally name the certificate it revoked in its response, and the client then compares that name against what it sent. Having sent neither an issuer name nor a serial number, it has nothing to compare against, and a server returning a specially crafted name causes the client to read from a NULL pointer and crash. The revocation response is checked for valid message protection before the affected code is reached, so an attacker must be a malicious or compromised CMP server, or a man-in-the-middle in possession of the secret used for message protection. Clients that identify the certificate to be revoked by a certificate or by issuer and serial number rather than by a PKCS#10 CSR are not affected. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-75806", "url": "https://ubuntu.com/security/CVE-2026-75806", "cve_description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attacker who can send a datagram that is routed to an existing DTLS 1.2 association can tear that association down without knowing any key material. This is a Denial of Service limited to the targeted association. There is no memory safety or confidentiality impact. CWE: CWE-1284: Improper Validation of Specified Quantity in Input Description: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher suite carries an explicit IV followed by the ciphertext and an authentication tag. When decrypting such a record the record layer passed the record length to the cipher implementation before checking that the record was long enough to contain the explicit IV and the tag. For a record shorter than that overhead the cipher implementation rejected the impossible length, and the record layer treated this as an internal failure and raised a fatal internal_error alert instead of treating the record as one that failed authentication. In TLS 1.2 the same record causes a fatal internal_error alert instead of the expected bad_record_mac alert. Since any undecryptable record already terminates a TLS connection, this is a protocol conformance issue rather than a security issue in TLS. The fix validates the record length against the explicit IV and tag length before any AEAD processing, so that TLS reports bad_record_mac and DTLS silently discards the record. FIPS impact: no The affected code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-77696", "url": "https://ubuntu.com/security/CVE-2026-77696", "cve_description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these secret values, forming a timing side-channel. Applications performing SM2 signature generation are affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84783", "url": "https://ubuntu.com/security/CVE-2026-84783", "cve_description": "Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certificate are built by several connections at the same time. This is a use-after-free read, which is likely to crash the process, resulting in a Denial of Service. CWE: CWE-416: Use After Free Description: OpenSSL caches the decoded values of a certificate's X.509v3 extensions inside the X509 object the first time they are needed. In OpenSSL 4.0 this cache is built in two phases: the extension values are computed while holding a read lock on the certificate, and the results are then installed into the certificate under a write lock. Because a read lock does not exclude other readers, several threads can compute the cache for the same certificate at the same time. Each thread that subsequently acquires the write lock installs its own results and frees the values installed by the thread before it, even though that earlier thread has already marked the cache as complete and may have returned pointers into it to its caller. A caller still using those pointers then reads freed memory. Any certificate shared between threads is exposed the first time its extensions are decoded. In TLS the certificates at risk are the trusted CA certificates supplied for chain verification, by whatever means, since these are shared by every connection and their extensions are decoded and cached the first time a chain is built to them. Certificates sent by the peer are decoded separately for each connection and are not shared, so they are not affected. In a TLS client verifying server certificates, or a TLS server that requests and verifies client certificates, the use-after-free could only occur if the first chains built to the same trusted CA are built by several connections at the same time. FIPS impact: no The FIPS module is not affected as X.509 certificate handling is outside of the OpenSSL FIPS module boundary. OpenSSL 4.0 is vulnerable to this issue. OpenSSL 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. This issue was reported on 27 August 2026 by Tim Becker (Xint.io) and independently in a public report on 31 August 2026 by aydinmercan. The fix has been developed by Bob Beck. -- cut (non-publishing metadata for internal use) -- Reported by: Tim Becker (Xint.io), aydinmercan Fixed by: Bob Beck", "cve_priority": "medium", "cve_public_date": "2026-09-29 16:17:00 UTC" }, { "cve": "CVE-2026-84784", "url": "https://ubuntu.com/security/CVE-2026-84784", "cve_description": "Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for every NEW_CONNECTION_ID frame it receives. The RETIRE_CONN_ID frame is dispatched via the Control Frame Queue (CFQ). If the remote peer also withholds ACKs, then it can force the local stack to allocate ~400MB (depending on ACK delay). CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: RFC 9000 sections 5.1.1 and 5.1.2 [1] describe the mechanism by which a remote peer can notify the local QUIC stack to change the destination connection ID (a.k.a. CID) the local stack uses to identify the connection at the remote peer. Each CID is associated with a sequence number. The sequence number is transmitted in NEW_CONNECTION_ID and RETIRE_CONNECTION_ID frames to identify the CID which is being either associated with a connection or retired. The remote peer sends a NEW_CONNECTION_ID frame to let the local stack know a new CID is being associated with an existing connection. The NEW_CONNECTION_ID frame carries the new CID, its sequence number, and the retire-prior-to number. The retire-prior-to identifies existing CIDs that are to be retired. The local QUIC stack must send a RETIRE_CONNECTION_ID for every destination CID whose sequence number is less than retire-prior-to. The CID becomes retired after the local stack receives an ACK for its RETIRE_CONNECTION_ID frame. Although the OpenSSL QUIC stack supports at most one destination CID for every connection, it can be tricked into processing more than one RETIRE_CONNECTION_ID frame per connection. The OpenSSL QUIC stack currently retires the destination CID as soon as it receives the NEW_CONNECTION_ID, while in fact the destination CID must be retired after an ACK for the RETIRE_CONNECTION_ID frame is received. Correcting the flawed logic also fixes the backlog growth. [1] https://datatracker.ietf.org/doc/html/rfc9000#name-issuing-connection-ids FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-09-29 16:17:00 UTC" } ], "log": [ "", " * Import 4.0.3", " - CVE-2026-84782 (\"DTLS Retransmits Handshake Messages From a Stale Buffer", " Offset\")", " - CVE-2026-35189 (\"Memory Allocation in Relative CRLDP Processing\")", " - CVE-2026-35191 (\"QUIC Unvalidated Amplification Credit may be Over", " Accounted\")", " - CVE-2026-42772 (\"Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC\")", " - CVE-2026-54872 (\"Timing Side-Channel in Scalar Multiplication for Non-NIST", " EC Curves\")", " - CVE-2026-54873 (\"QUIC STREAM Fragment Metadata DoS\")", " - CVE-2026-54875 (\"Non-Constant-Time SM2 Scalar Multiplication on ARM64 and", " RISC-V\")", " - CVE-2026-72897 (\"Out-of-Bounds Access After SSL_set_SSL_CTX() During a", " Handshake\")", " - CVE-2026-75804 (\"QUIC Connection-Level Flow Control is Not Enforced for", " Streams\")", " - CVE-2026-75805 (\"NULL Pointer Dereference in CMP Client Revocation", " Response Handling\")", " - CVE-2026-75806 (\"Unauthenticated and Undersized DTLS 1.2 AEAD Record", " Causes DoS\")", " - CVE-2026-77696 (\"Timing Side-Channel in SM2 Signature Generation\")", " - CVE-2026-84783 (\"Use-After-Free in X.509 Extension Cache Under Concurrent Use\")", " - CVE-2026-84784 (\"QUIC: Unbounded RETIRE_CONNECTION_ID Backlog\")", "" ], "package": "openssl", "version": "4.0.3-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 29 Sep 2026 21:40:01 +0200" }, { "cves": [ { "cve": "CVE-2026-18798", "url": "https://ubuntu.com/security/CVE-2026-18798", "cve_description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack default packet handler (port_default_packet_handler()) creates a so-called QRX object. If the initial packet validates successfully with QRX object, the default packet handler proceeds to channel (connection object) creation. The QRX object used for packet validation is passed to port_bind_channel(), so it becomes part of the newly created connection. If port_bind_channel() fails, then it also frees the QRX object. Once port_bind_channel() returns, the port_default_packet_handler() detects the failure and proceeds to the error branch, where the same QRX object is freed for the second time. The failure in port_bind_channel() function can be induced with a relatively low effort by a malformed (non RFC 9000 compliant) INITIAL packet. If the packet carries DCID (destination connection ID) which is shorter than 8 bytes, then port_bind_channel() jumps to the error path after ossl_quic_lcidm_enrol_odcid() detects that the DCID has invalid length. FIPS impact: no The FIPS module is not affected, as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-63072", "url": "https://ubuntu.com/security/CVE-2026-63072", "cve_description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: CWE-787: Out-of-bounds Write Description: The key-wrap OID is potentially attacker-controlled on the wire. CMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers. An attacker can take a legitimate message and change a single OID byte to select the padded variant while leaving the message otherwise valid. Since the unwrap key is derived from the recipient's private operation (ECDH key agreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot pass, and the decryption fails with integrity failure. The write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the allocation, requires no special configuration, and is reachable from the public CMS_decrypt() function. The consequence is a heap corruption leading to a Denial of Service. The fix in the CMS code sizes the unwrap output buffer for the worst case so a failed unwrap cannot write past the allocation. FIPS impact: no As the CMS code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63076", "url": "https://ubuntu.com/security/CVE-2026-63076", "cve_description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "medium", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14457", "url": "https://ubuntu.com/security/CVE-2026-14457", "cve_description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible. CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA). When the private key is configured along with a matching certificate, the \"signature_algorithms_cert\" extension is handled reliably even without the fix, and peer clients or servers that don't support raw public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate or its public key. Deployments that prefer to configure just a private key with no certificate need to upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue, as the SSL protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:17:00 UTC" }, { "cve": "CVE-2026-54874", "url": "https://ubuntu.com/security/CVE-2026-54874", "cve_description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have already moved on to the next epoch (for example, having sent its ChangeCipherSpec and Finished messages) before the local endpoint has processed the same transition, typically because of reordering on the underlying UDP transport. OpenSSL buffers such early records so that they can be processed once the local endpoint catches up. Buffering a record currently retains the entire read buffer it arrived in, which is sized to hold the largest possible DTLS record (around 16 kilobytes), rather than just the bytes that make up the record itself. Up to 100 such records may be buffered per connection. As a result, a peer that sends a stream of small forged records claiming to belong to the next epoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of memory, despite sending only a small fraction of that amount of data over the network. An attacker therefore gains a memory amplification factor of around 1200, and can multiply the effect across as many associations as it is able to open, making this a remote memory exhaustion Denial of Service risk for DTLS servers. Since the memory retained per connection remains bounded, and any limit an application already places on the number of concurrent associations also bounds the total exposure, this issue has been assessed as Low severity. FIPS impact: no No FIPS modules are affected by this issue as the affected code is outside the OpenSSL FIPS module boundary. OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 4.0 users should upgrade to OpenSSL 4.0.2. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.4. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.8. OpenSSL 3.4 users should upgrade to OpenSSL 3.4.7. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.22. Premium support customers only: OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr This issue was reported on 18 May 2026 by Amazon Web Services. The fix has been developed by Matt Caswell. -- cut (non-publishing metadata for internal use) -- Reported by: Amazon Web Services Fixed by: Matt Caswell", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63073", "url": "https://ubuntu.com/security/CVE-2026-63073", "cve_description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() converts the peer-supplied sender distinguished name with X509_NAME_oneline() and passes it directly as the format argument to ERR_raise_data(). Percent characters survive the conversion, so a sender DN such as \"CN=%s%n\" reaches BIO_vsnprintf() as an attacker-controlled format string with no matching variadic arguments. This path is only reached when the caller configures an expected sender or pins a server certificate, which is the normal configuration for a CMP client validating server responses. Since the attacker controls the format string but none of the variadic arguments, such specifiers as %s and %n dereference or write through unrelated stack contents and crash the client. The reliable consequence is a denial of service, when the response comes from a malicious or intercepted CMP endpoint. There is no controlled memory write, arbitrary-address read, or reliable path to remote code execution. FIPS impact: no No FIPS modules are affected by this issue, as the CMP protocol implementation is outside the OpenSSL FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63074", "url": "https://ubuntu.com/security/CVE-2026-63074", "cve_description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbounded memory growth in the event a malicious client repeatedly sends requests containing unique extra certificates, which may lead to OOM conditions. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: If a remote user sends CMP messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remains in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to Denial of Service attacks in which an attacker sends messages intending to be rejected with a large list of additional certificates repeatedly, forcing the server to store them indefinitely. The issue was fixed by removing the added extra certs if the message is rejected, using the same method as when the context is configured to not do caching at all. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-63075", "url": "https://ubuntu.com/security/CVE-2026-63075", "cve_description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-75803", "url": "https://ubuntu.com/security/CVE-2026-75803", "cve_description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.", "cve_priority": "low", "cve_public_date": "2026-08-25 13:19:00 UTC" }, { "cve": "CVE-2026-14456", "url": "https://ubuntu.com/security/CVE-2026-14456", "cve_description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-54876", "url": "https://ubuntu.com/security/CVE-2026-54876", "cve_description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL verification flags, for example when a TLS client verifies an OCSP response stapled into the TLS handshake by the server. When the received BasicOCSPResponse contains an empty SEQUENCE OF SingleResponse, which is permitted on the wire and accepted by the OpenSSL decoder, the OCSP_BASICRESP structure allocated by OCSP_response_get1_basic() was not freed because an early return bypassed the cleanup code at the end of the function. The amount of memory leaked per handshake can be amplified by the attacker by padding the certs field of the BasicOCSPResponse with bogus certificates, which are parsed and stored in the leaked structure before the empty response check triggers the early return. A long-running TLS client that repeatedly connects to a malicious server can have its memory exhausted over time. OCSP response checking is not enabled by default. Only client applications that explicitly enable the OCSP response check verification flags are affected. FIPS impact: no The FIPS modules in 4.0 and 3.6 are not affected by this issue as the affected code is outside the OpenSSL FIPS module boundary.", "cve_priority": "medium", "cve_public_date": "2026-08-05 15:16:00 UTC" } ], "log": [ "", " * Import 4.0.2", " - CVE-2026-18798 (\"QUIC Server May Trigger Double Free When Processing", " INITIAL Packet\")", " - CVE-2026-63072 (\"Heap Buffer Overflow in CMS Key Unwrapping\")", " - CVE-2026-63076 (\"Invalid Pointer Dereference in CMP Server via Crafted", " protectionAlg\")", " - CVE-2026-14457 (\"RPK Server Signature Algorithm Selection Can Dereference", " a Missing Certificate\")", " - CVE-2026-54874 (\"Excessive Memory Use Buffering DTLS Records for a Future", " Epoch\")", " - CVE-2026-63073 (\"Untrusted Sender DN Used as Format String in CMP Response", " Validation\")", " - CVE-2026-63074 (\"CMP Indefinite Cache Growth of ExtraCerts\")", " - CVE-2026-63075 (\"QUIC ACK-only Packet Retention Can Cause Memory", " Exhaustion\")", " - CVE-2026-75803 (\"AEAD Forgeries with Empty Ciphertext When Using", " EVP_Cipher()\") (Closes: #1145172)", " - CVE-2026-14456 (\"Unbounded Memory Growth in QUIC Server Incoming Channel", " Queue\") (Closes: #1144615)", " - CVE-2026-54876 (\"Client-Side Memory Leak in OCSP Response Checking\") (Closes: #1143841)", "" ], "package": "openssl", "version": "4.0.2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Sebastian Andrzej Siewior ", "date": "Tue, 25 Aug 2026 21:19:42 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "parted", "from_version": { "source_package_name": "parted", "source_package_version": "3.7-1", "version": "3.7-1" }, "to_version": { "source_package_name": "parted", "source_package_version": "3.8-2", "version": "3.8-2" }, "cves": [ { "cve": "CVE-2026-89085", "url": "https://ubuntu.com/security/CVE-2026-89085", "cve_description": "[heap buffer overflow in _init_fats / fat_table_read]", "cve_priority": "medium", "cve_public_date": "2026-09-17" }, { "cve": "CVE-2026-89088", "url": "https://ubuntu.com/security/CVE-2026-89088", "cve_description": "[heap buffer overflow in duplicate_legacy_root_dir]", "cve_priority": "medium", "cve_public_date": "2026-09-17" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Reupload pointing dgit to the correct upstream tag.", "" ], "package": "parted", "version": "3.8-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 25 Sep 2026 10:10:23 +0100" }, { "cves": [ { "cve": "CVE-2026-89085", "url": "https://ubuntu.com/security/CVE-2026-89085", "cve_description": "[heap buffer overflow in _init_fats / fat_table_read]", "cve_priority": "medium", "cve_public_date": "2026-09-17" }, { "cve": "CVE-2026-89088", "url": "https://ubuntu.com/security/CVE-2026-89088", "cve_description": "[heap buffer overflow in duplicate_legacy_root_dir]", "cve_priority": "medium", "cve_public_date": "2026-09-17" } ], "log": [ "", " * New upstream release:", " - CVE-2026-89085, CVE-2026-89088: Catch errors triggered by bad FAT", " metadata (closes: #1148169).", "" ], "package": "parted", "version": "3.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Fri, 25 Sep 2026 09:31:05 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "passwd", "from_version": { "source_package_name": "shadow", "source_package_version": "1:4.19.3-2ubuntu1", "version": "1:4.19.3-2ubuntu1" }, "to_version": { "source_package_name": "shadow", "source_package_version": "1:4.19.3-2ubuntu2", "version": "1:4.19.3-2ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No change rebuild with debhelper 14.5ubuntu1 to drop dependency from", " passwd to systemd.", "" ], "package": "shadow", "version": "1:4.19.3-2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Michael Hudson-Doyle ", "date": "Wed, 23 Sep 2026 10:13:29 +1200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-dateutil", "from_version": { "source_package_name": "python-dateutil", "source_package_version": "2.9.0-4build1", "version": "2.9.0-4build1" }, "to_version": { "source_package_name": "python-dateutil", "source_package_version": "2.9.0-5", "version": "2.9.0-5" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Tianyu Chen ]", " * Team upload.", " * Fix test failure with pytest 9.1. (Closes: #1140874)", " * Remove redundant Priority: optional from source stanza.", " * Set field Upstream-Name in debian/copyright.", " * Update standards version to 4.7.4, no changes needed.", " * Removed Rules-Requires-Root", " * Set upstream metadata fields: Documentation.", " * Update watch file format version to 5 and use PyPI template", " * Clean .egg-info. (Closes: #1046049)", "", " [ Alexandre Detiste ]", " * quilt is the default now", "", " [ Jeroen Ploemen ]", " * Rules: convert overrides to execute_after.", "" ], "package": "python-dateutil", "version": "2.9.0-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Tianyu Chen ", "date": "Thu, 09 Jul 2026 00:34:09 +0800" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distro-info", "from_version": { "source_package_name": "distro-info", "source_package_version": "1.17", "version": "1.17" }, "to_version": { "source_package_name": "distro-info", "source_package_version": "1.19", "version": "1.19" }, "cves": [], "launchpad_bugs_fixed": [ 2131678 ], "changes": [ { "cves": [], "log": [ "", " * Makefile: remove python/.mypy_cache on clean", "" ], "package": "distro-info", "version": "1.19", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Tue, 29 Sep 2026 12:41:41 +0200" }, { "cves": [], "log": [ "", " * Support Ubuntu Pro with Legacy add-on (LP: #2131678):", " - ubuntu-distro-info: add --supported-legacy", " - python: add UbuntuDistroInfo.supported_legacy", " - perl: add UbuntuDistroInfo.supported_legacy", " * Add test cases for ubuntu-distro-info --supported-esm", "" ], "package": "distro-info", "version": "1.18", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [ 2131678 ], "author": "Benjamin Drung ", "date": "Mon, 28 Sep 2026 16:01:16 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-distupgrade", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.9", "version": "1:26.10.9" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.10", "version": "1:26.10.10" }, "cves": [], "launchpad_bugs_fixed": [ 2167515, 2167516 ], "changes": [ { "cves": [], "log": [ "", " * DistUpgradeCache: allow openssh-server to be removed despite being in", " the removal denylist when openssh-server-gssapi, which replaces it, is", " being installed or upgraded in the same transaction (LP: #2167515)", " * DistUpgradeQuirks: detect systems using openssh with GSSAPI and select", " the openssh-server-gssapi and/or openssh-client-gssapi variants instead", " of the base packages when upgrading to 26.10 or later (LP: #2167516)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167515, 2167516 ], "author": "Andreas Hasenack ", "date": "Sun, 20 Sep 2026 16:56:27 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-launchpadlib", "from_version": { "source_package_name": "python-launchpadlib", "source_package_version": "2.1.0-1build1", "version": "2.1.0-1build1" }, "to_version": { "source_package_name": "python-launchpadlib", "source_package_version": "2.1.0-2", "version": "2.1.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", "", " [ Alexandre Detiste ]", " * Remove redundant Priority: optional from source stanza.", " * Upgrade upstream signing key to new packet format.", " * Update standards version to 4.7.4, no changes needed.", " * Stop Suggesting removed python3-pkg-resources.", " * Drop \"Rules-Requires-Root: no\": it is the default now.", " * Rewrite d/watch in v5 format.", " * Add debian/salsa-ci.yml.", " * Use dh-sequence-python3.", "", " [ Colin Watson ]", " * Remove pkg_resources (closes: #1147419).", "" ], "package": "python-launchpadlib", "version": "2.1.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Tue, 15 Sep 2026 16:27:15 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-netplan", "from_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-1", "version": "1.2.2-1" }, "to_version": { "source_package_name": "netplan.io", "source_package_version": "1.2.2-3", "version": "1.2.2-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " [ Grayson Wolf ]", " * d/p/lp2168838-ovs-test.patch: Fix autopkgtests on ovs 4 (Closes: #1149299)", "" ], "package": "netplan.io", "version": "1.2.2-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Wed, 30 Sep 2026 20:59:16 +0200" }, { "cves": [], "log": [ "", " * d/t/prep-testbed: Remove LXC quirks (Closes: #1144818)", " which are not needed for incus-lxc anymore.", "" ], "package": "netplan.io", "version": "1.2.2-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Lukas Märdian ", "date": "Thu, 27 Aug 2026 18:12:25 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-requests", "from_version": { "source_package_name": "requests", "source_package_version": "2.34.2-1", "version": "2.34.2-1" }, "to_version": { "source_package_name": "requests", "source_package_version": "2.34.2-1ubuntu1", "version": "2.34.2-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2166950, 2166950 ], "changes": [ { "cves": [], "log": [ "", " * d/p/0003-help-Catch-AttributeError-from-urllib3-contrib-pyopenssl.patch:", " Catch AttributeError when importing urllib3.contrib.pyopenssl in", " requests.help (LP: #2166950)", " * d/p/0004-certs-Add-SKID-and-AKID-extensions.patch: add subjectKeyIdentifier", " and authorityKeyIdentifier to the regenerated test certificates", " (LP: #2166950)", "" ], "package": "requests", "version": "2.34.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166950, 2166950 ], "author": "Grayson Wolf ", "date": "Tue, 15 Sep 2026 17:30:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-software-properties", "from_version": { "source_package_name": "software-properties", "source_package_version": "0.122", "version": "0.122" }, "to_version": { "source_package_name": "software-properties", "source_package_version": "0.123", "version": "0.123" }, "cves": [], "launchpad_bugs_fixed": [ 2161023 ], "changes": [ { "cves": [], "log": [ "", " * cloudarchive: Enable support for Hibiscus (2026.2) UCA on Resolute (26.04)", " (LP: #2161023).", "" ], "package": "software-properties", "version": "0.123", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2161023 ], "author": "Himawan Winarto ", "date": "Fri, 04 Sep 2026 13:51:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-typing-extensions", "from_version": { "source_package_name": "python-typing-extensions", "source_package_version": "4.16.0-4", "version": "4.16.0-4" }, "to_version": { "source_package_name": "python-typing-extensions", "source_package_version": "4.16.0-5", "version": "4.16.0-5" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Remove obsolete Literal deduplication assertion (closes: #1145112).", "" ], "package": "python-typing-extensions", "version": "4.16.0-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 23 Aug 2026 12:50:26 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3-urllib3", "from_version": { "source_package_name": "python-urllib3", "source_package_version": "2.7.0-3", "version": "2.7.0-3" }, "to_version": { "source_package_name": "python-urllib3", "source_package_version": "2.8.0-1", "version": "2.8.0-1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team upload.", " * New upstream release:", " - GHSA-8988-9cw3-xx77: The TLS configuration for HTTPS proxies could be", " ignored or overridden.", " - GHSA-vxq7-64xx-v4gw: HTTPResponse.stream() and read_chunked() could", " buffer a chunk-size line of unbounded length in memory.", " - GHSA-gh4c-6fx4-qh6g: Chunked Deflate streaming could enter an infinite", " loop.", " * Drop python3-backports.zstd build/test-dependencies.", " * Skip tests that fail due to recent changes in Python.", "" ], "package": "python-urllib3", "version": "2.8.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Colin Watson ", "date": "Sun, 20 Sep 2026 14:30:46 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14-gdbm", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "python3.14-minimal", "from_version": { "source_package_name": "python3.14", "source_package_version": "3.14.7-4ubuntu1", "version": "3.14.7-4ubuntu1" }, "to_version": { "source_package_name": "python3.14", "source_package_version": "3.14.8-1ubuntu1", "version": "3.14.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 22:09:47 +0200" }, { "cves": [], "log": [ "", " * Python 3.14.8 release.", " * Refresh patches.", "" ], "package": "python3.14", "version": "3.14.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Thu, 01 Oct 2026 21:55:55 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Revert the module-install-* autopkg tests to run with setuptools v78.", "" ], "package": "python3.14", "version": "3.14.7-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:49:39 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-27.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 27 Sep 2026 09:22:20 +0200" }, { "cves": [], "log": [ "", " * Update to the 3.14 branch 2026-09-20.", " * Update devhelp documentation for devhelp format v2 (Simon McVittie).", " Addresses: #1147626.", "" ], "package": "python3.14", "version": "3.14.7-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 20 Sep 2026 08:42:22 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "rsync", "from_version": { "source_package_name": "rsync", "source_package_version": "3.4.4+ds1-1build1", "version": "3.4.4+ds1-1build1" }, "to_version": { "source_package_name": "rsync", "source_package_version": "3.5.0+ds1-2", "version": "3.5.0+ds1-2" }, "cves": [ { "cve": "CVE-2026-53783", "url": "https://ubuntu.com/security/CVE-2026-53783", "cve_description": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53784", "url": "https://ubuntu.com/security/CVE-2026-53784", "cve_description": "rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53785", "url": "https://ubuntu.com/security/CVE-2026-53785", "cve_description": "rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53786", "url": "https://ubuntu.com/security/CVE-2026-53786", "cve_description": "rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53788", "url": "https://ubuntu.com/security/CVE-2026-53788", "cve_description": "rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53789", "url": "https://ubuntu.com/security/CVE-2026-53789", "cve_description": "rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53790", "url": "https://ubuntu.com/security/CVE-2026-53790", "cve_description": "rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53791", "url": "https://ubuntu.com/security/CVE-2026-53791", "cve_description": "rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53792", "url": "https://ubuntu.com/security/CVE-2026-53792", "cve_description": "rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53793", "url": "https://ubuntu.com/security/CVE-2026-53793", "cve_description": "rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53794", "url": "https://ubuntu.com/security/CVE-2026-53794", "cve_description": "rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53795", "url": "https://ubuntu.com/security/CVE-2026-53795", "cve_description": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53796", "url": "https://ubuntu.com/security/CVE-2026-53796", "cve_description": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53797", "url": "https://ubuntu.com/security/CVE-2026-53797", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53798", "url": "https://ubuntu.com/security/CVE-2026-53798", "cve_description": "rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53799", "url": "https://ubuntu.com/security/CVE-2026-53799", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53800", "url": "https://ubuntu.com/security/CVE-2026-53800", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53801", "url": "https://ubuntu.com/security/CVE-2026-53801", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53802", "url": "https://ubuntu.com/security/CVE-2026-53802", "cve_description": "rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53803", "url": "https://ubuntu.com/security/CVE-2026-53803", "cve_description": "rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70452", "url": "https://ubuntu.com/security/CVE-2026-70452", "cve_description": "rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70453", "url": "https://ubuntu.com/security/CVE-2026-70453", "cve_description": "rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70454", "url": "https://ubuntu.com/security/CVE-2026-70454", "cve_description": "rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70455", "url": "https://ubuntu.com/security/CVE-2026-70455", "cve_description": "rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70456", "url": "https://ubuntu.com/security/CVE-2026-70456", "cve_description": "rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70457", "url": "https://ubuntu.com/security/CVE-2026-70457", "cve_description": "rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70458", "url": "https://ubuntu.com/security/CVE-2026-70458", "cve_description": "rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70459", "url": "https://ubuntu.com/security/CVE-2026-70459", "cve_description": "rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70460", "url": "https://ubuntu.com/security/CVE-2026-70460", "cve_description": "rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70461", "url": "https://ubuntu.com/security/CVE-2026-70461", "cve_description": "rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70462", "url": "https://ubuntu.com/security/CVE-2026-70462", "cve_description": "rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70463", "url": "https://ubuntu.com/security/CVE-2026-70463", "cve_description": "rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70464", "url": "https://ubuntu.com/security/CVE-2026-70464", "cve_description": "rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * d/rsync.NEWS: Fix date in latest entry", " * d/p/testsuite_make_basis_xname...: Pull patch to fix the hurd-i386 FTBFS", " * d/p/testsuite_interpose_lfs...: New patch to fix the i386 and alpha FTBFS", " * d/p/testsuite_punch_granularity...: New patch to fix the loong64 FTBFS", "" ], "package": "rsync", "version": "3.5.0+ds1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Tue, 18 Aug 2026 20:48:16 -0700" }, { "cves": [ { "cve": "CVE-2026-53783", "url": "https://ubuntu.com/security/CVE-2026-53783", "cve_description": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53784", "url": "https://ubuntu.com/security/CVE-2026-53784", "cve_description": "rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53785", "url": "https://ubuntu.com/security/CVE-2026-53785", "cve_description": "rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53786", "url": "https://ubuntu.com/security/CVE-2026-53786", "cve_description": "rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53788", "url": "https://ubuntu.com/security/CVE-2026-53788", "cve_description": "rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53789", "url": "https://ubuntu.com/security/CVE-2026-53789", "cve_description": "rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53790", "url": "https://ubuntu.com/security/CVE-2026-53790", "cve_description": "rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53791", "url": "https://ubuntu.com/security/CVE-2026-53791", "cve_description": "rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53792", "url": "https://ubuntu.com/security/CVE-2026-53792", "cve_description": "rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53793", "url": "https://ubuntu.com/security/CVE-2026-53793", "cve_description": "rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53794", "url": "https://ubuntu.com/security/CVE-2026-53794", "cve_description": "rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53795", "url": "https://ubuntu.com/security/CVE-2026-53795", "cve_description": "rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53796", "url": "https://ubuntu.com/security/CVE-2026-53796", "cve_description": "rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can substitute a symlink for a component of the destination path between the path resolution and chdir() call, causing the receiver's working directory to be established outside the intended destination tree so that subsequent relative-path file writes land in unintended filesystem locations.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53797", "url": "https://ubuntu.com/security/CVE-2026-53797", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with a symlink pointing outside the source root between path resolution and file open operations to disclose file contents outside the intended transfer root.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53798", "url": "https://ubuntu.com/security/CVE-2026-53798", "cve_description": "rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53799", "url": "https://ubuntu.com/security/CVE-2026-53799", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53800", "url": "https://ubuntu.com/security/CVE-2026-53800", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink() call, causing rsync to delete the symlink target rather than the intended source file.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53801", "url": "https://ubuntu.com/security/CVE-2026-53801", "cve_description": "rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53802", "url": "https://ubuntu.com/security/CVE-2026-53802", "cve_description": "rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-53803", "url": "https://ubuntu.com/security/CVE-2026-53803", "cve_description": "rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70452", "url": "https://ubuntu.com/security/CVE-2026-70452", "cve_description": "rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70453", "url": "https://ubuntu.com/security/CVE-2026-70453", "cve_description": "rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70454", "url": "https://ubuntu.com/security/CVE-2026-70454", "cve_description": "rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70455", "url": "https://ubuntu.com/security/CVE-2026-70455", "cve_description": "rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70456", "url": "https://ubuntu.com/security/CVE-2026-70456", "cve_description": "rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70457", "url": "https://ubuntu.com/security/CVE-2026-70457", "cve_description": "rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70458", "url": "https://ubuntu.com/security/CVE-2026-70458", "cve_description": "rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70459", "url": "https://ubuntu.com/security/CVE-2026-70459", "cve_description": "rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70460", "url": "https://ubuntu.com/security/CVE-2026-70460", "cve_description": "rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:19:00 UTC" }, { "cve": "CVE-2026-70461", "url": "https://ubuntu.com/security/CVE-2026-70461", "cve_description": "rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70462", "url": "https://ubuntu.com/security/CVE-2026-70462", "cve_description": "rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70463", "url": "https://ubuntu.com/security/CVE-2026-70463", "cve_description": "rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" }, { "cve": "CVE-2026-70464", "url": "https://ubuntu.com/security/CVE-2026-70464", "cve_description": "rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients.", "cve_priority": "medium", "cve_public_date": "2026-08-13 15:20:00 UTC" } ], "log": [ "", " [ Sylvain Beucler ]", " * autopkgtest improvements", " * Drop allow-stderr autopkgtest restriction", "", " [ Samuel Henrique ]", " * New upstream version 3.5.0+ds1, fixing 33 CVEs:", " - CVE-2026-53783: rrsync restricted-directory escape", " (validation-vs-exec race + unsafe option allowlist)", " - CVE-2026-53784: Daemon module-root chdir escape under \"use chroot =", " no\"", " - CVE-2026-53785: --relative implied-parent creation escapes the", " destination tree", " - CVE-2026-53786: Daemon --filter merge file bypasses the module filter", " list", " - CVE-2026-53788: Daemon name-converter accepts newline-bearing names", " into its line protocol", " - CVE-2026-53789: Malicious sender expands --delete scope by", " reclassifying an implied parent", " - CVE-2026-53790: Command / argument injection via unquoted peer- or", " host-controlled values", " - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the", " daemon's source address", " - CVE-2026-53792: Receiver-supplied zero checksum block length drives", " sender matching negative", " - CVE-2026-53793: Chroot \"/./\" inner-module escape via a", " parent-component symlink", " - CVE-2026-53794: Remote peer disables the per-allocation sanity cap", " via --max-alloc=0", " - CVE-2026-53795: Receiver write escape via an absolute --temp-dir /", " --link-dest disabling rename/link confinement", " - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race", " (TOCTOU)", " - CVE-2026-53797: Sender source-tree parent-component symlink race ->", " out-of-tree disclosure", " - CVE-2026-53798: Daemon name-converter empty response maps an unknown", " name to uid/gid 0", " - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race", " -> arbitrary ACL set (local privilege escalation)", " - CVE-2026-53800: Sender --remove-source-files unlink follows a", " parent-component symlink race -> arbitrary file deletion outside the", " source tree", " - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the", " transfer root / module -> out-of-tree disclosure", " - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked", " operator-supplied input files", " - CVE-2026-53803: Arbitrary file write / privilege escalation via", " symlinked operator-supplied output paths", " - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname", " cannot be resolved, admitting the host it was meant to block", " - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a", " crafted equal-weak-checksum chain", " - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS", " connection (no CA verification; no stunnel hostname binding)", " - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an", " rsync daemon", " - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when", " the argument count lands exactly on maxargs", " - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg()", " error formatting", " - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry", " accepted without -H", " - CVE-2026-70459: Per-connection daemon child crash from a crafted", " first incremental file list with a non-directory transfer root", " - CVE-2026-70460: Daemon module-root escape through a peer-supplied", " --partial-dir / --backup-dir resolving via an in-module symlink", " - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in", " add_implied_include()", " - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own", " I/O timeout (signed overflow, and a non-positive value)", " - CVE-2026-70463: \"auth users\" ignores documented comma-only parsing,", " silently skipping a deny/read-only rule", " - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out", " an rsync daemon module", " * d/p/skip_devices_test_non_linux.patch: Drop patch applied upstream", " * d/patches:", " - Pull 3 patches for regression fixes:", " ~ Honor_STRIP_in_install-strip_for_cross-compilation.patch", " ~ rrsync_support_fd_pins_in_user_namespaces.patch", " ~ testsuite_bound_the_unshare_probe.patch", " * d/rsync.NEWS: Add a NEWS entry about all the behavior changes", "" ], "package": "rsync", "version": "3.5.0+ds1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Sun, 16 Aug 2026 11:00:00 -0700" } ], "notes": null, "is_version_downgrade": false }, { "name": "rust-coreutils", "from_version": { "source_package_name": "rust-coreutils", "source_package_version": "0.11.0-2ubuntu2", "version": "0.11.0-2ubuntu2" }, "to_version": { "source_package_name": "rust-coreutils", "source_package_version": "0.12.0-1ubuntu2", "version": "0.12.0-1ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [ 2151166, 2166225, 2152801, 2116290, 2130465, 2165041, 2164777, 2164777, 2130465, 2165041, 2163175, 2134860, 2159679, 2132368, 2137580, 2142900, 2150342, 2157011, 2157342, 2116290, 2158691, 2160614, 2153168, 2154338, 2154042, 2152801, 2146819, 2146818, 2155763, 2147425, 2143711, 2115782, 2125263, 2142588, 2141441, 2139697, 2138315, 2138217, 2134578, 2133156, 2132941, 2132245, 2132150, 2130859, 2130843, 2130396, 2127851, 2125943, 2125504, 2122166, 2117771, 2138304, 2138377, 2127970, 2125578, 2127970, 2125535, 2125578, 2121635, 2112491, 2115033, 2111603, 2116973, 2118785, 2117466, 2114827, 2116859, 2116886, 2112445, 2112552, 2113983, 2114706, 2114886, 2114887, 2114970, 2115147, 2116572, 2110910, 2111714, 2115196, 2111882, 2113963, 2115035, 2111211 ], "changes": [ { "cves": [], "log": [ "", " * d/patches/fix-install-d-eexist-race.patch: Fix an issue where parallel", " invocations of install -D would result in an EEXIST race (LP: #2151166)", "" ], "package": "rust-coreutils", "version": "0.11.0-2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2151166 ], "author": "Simon Johnsson ", "date": "Mon, 14 Sep 2026 17:15:39 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes: (LP: #2166225)", " - Install hardlinks: Rename rust-coreutils.links to", " rust-coreutils.hardlinks.", " - Remove Build-Depends on lld and use the default linker because lld is", " unavailable on some partial architectures such as i386.", " - d/rules: Add the multiarch library path needed when linking systemd", " support (LP: #2152801).", " - d/rules: Use Ubuntu's dh-cargo-vendored-sources helper and skip known", " failing tests.", " - d/control: Regenerate XS-Vendored-Sources-Rust for Ubuntu.", " - d/p/Tweak-release-build-profile.patch: Balance binary size and debug", " information.", " - d/p/dd-ensure-full-writes.patch: Handle partial writes to slow pipes.", " - d/p/rust-vendor/glibc-2.42.patch: Support the glibc 2.42 speed_t change.", " - d/p/rustix-use-libc-backend.patch: Route rustix syscalls through libc.", " - d/p/require-utility-to-be-invoked-at-matching-path.patch: Preserve", " pathname-based AppArmor policy semantics.", " - d/p/df-statfs-fallback.patch: Retain the direct statfs fallback when", " mount table paths are inaccessible (LP: #2116290).", " - d/p/cp-stop-resolving-cwd.patch: Avoid resolving cwd for absolute", " recursive copies (LP: #2130465).", " - Remove Debian's fix-ppc64el-baudrate.diff, which fails on Launchpad's", " ppc64el builders.", " - Fix Lintian warnings.", " * Drop Changes:", " - Install libstdbuf.so: adopted by Debian in 0.11.0-1.", " - Enable feat_systemd_logind and add libsystemd-dev: adopted by Debian in", " 0.11.0-1; the Ubuntu multiarch linker-path adjustment remains.", " - d/p/remove-workspace-members.patch: adopted by Debian in 0.11.0-1.", " - d/p/build-stty.patch: no longer needed by the 0.11 Unix feature set.", " - d/p/cp-fix-symlink-target-permissions.patch: fixed upstream", " (LP: #2165041).", " - d/p/cp-fix-umask-permission-denied.patch: fixed upstream", " (LP: #2164777).", " - The 0.10 vendored-crate refresh: superseded by Debian's 0.11 refresh.", "" ], "package": "rust-coreutils", "version": "0.11.0-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166225, 2152801, 2116290, 2130465, 2165041, 2164777 ], "author": "Varun Varma ", "date": "Mon, 07 Sep 2026 21:33:10 -0400" }, { "cves": [], "log": [ "", " [ Simon Johnsson ]", " * d/p/cp-fix-umask-permission-denied.patch: Fix an issue where cp would fail", " with \"Permission denied\" if umask masked the owner's write permission", " (LP: #2164777).", "", " [ Varun Varma ]", " * d/p/cp-stop-resolving-cwd.patch: cp: avoid resolving cwd", " for absolute recursive copies (LP: #2130465).", " * Fix Lintian warnings.", "" ], "package": "rust-coreutils", "version": "0.10.0-1ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2164777, 2130465 ], "author": "Varun Varma ", "date": "Tue, 01 Sep 2026 12:04:54 -0400" }, { "cves": [], "log": [ "", " * d/p/cp-fix-symlink-target-permissions.patch: Fix an issue where cp", " would alter the permissions of the source file, such as stripping the", " setuid bit (LP: #2165041)", "" ], "package": "rust-coreutils", "version": "0.10.0-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2165041 ], "author": "Simon Johnsson ", "date": "Wed, 26 Aug 2026 16:29:49 +0200" }, { "cves": [], "log": [ "", " [ Simon Johnsson ]", " * Merge with Debian unstable. Remaining changes: (LP: #2163175)", " - Install libstdbuf.so: Modify d/rules to export LIBSTDBUF_DIR as to not", " skip stdbuf, fix libstdbuf.so permissions, and install it in", " rust-coreutils.install.", " - Install hardlinks: Rename rust-coreutils.links to", " rust-coreutils.hardlinks.", " - Enable feat_systemd_logind: This allows commands such as who and pinky", " to work correctly. Introduces libsystemd-dev as a dependency.", " - Remove Build-Depends on lld: Debian added it as the preferred linker,", " but some partial architectures like i386 may be missing it.", " - d/rules: Fix vendored sources field creation. Debian does not have", " access to dh-cargo-vendored-sources so it uses a script instead.", " Change it to use dh-cargo-vendored-sources on Ubuntu instead.", " - d/rules: Skip failing tests.", " - Add patches:", " + build-stty", " + dd-ensure-full-writes", " + require-utility-to-be-invoked-at-matching-path", " + Tweak-release-build-profile", " + rust-vendor/glibc-2.42", " + rustix-use-libc-backend", " - Remove upstream patches:", " + fix-ppc64el-baudrate.diff: Launchpad's builders instead fails on", " ppc64le for this patch, the original source code is correct.", " - Update vendored rust crates", " - debian/control: Update XS-Vendored-Sources-Rust field", " * Drop changes:", " - Remove patches fixed upstream:", " + cp-respect-composite-flag", " + fix-cp-parents", " + fix-incomplete-locale-bundles", " + fix-locale-path: Debian adopted this patch.", " * New changes:", " - debian/patches/remove-workspace-members.patch: Remove workspace member", " array to prevent dh-cargo bypassing workspace-exclude.patch. Otherwise", " vendored dependencies would still think that they're part of the", " workspace.", " * Fixes:", " - File ownership changes when a file is mv'ed by root to a different file", " system (LP: #2134860)", " - Failing to build images: mv resolv.conf.tmp", " /build/chroot/etc/resolv.conf mv: File exists (os error 17)", " (LP: #2159679)", " - unaligned plus in \"ls -l\" output (LP: #2132368)", " - git-buildpackage ftbfs on resolute-proposed due to rust coreutils", " (LP: #2137580)", " - env: signal flags do not understand RTMIN+n notation (LP: #2142900)", " - date: width prefix in %N format specifier is ignored", " ( %3N, %6N always output full 9 nanosecond digits) (LP: #2150342)", " - changes in behaviour of cp in coreutils-from-uutils break test case in", " util-linux (LP: #2157011)", " - systemd: TEST-45-TIMEDATE is flaky with rust coreutils (LP: #2157342)", "", " [ Varun Varma ]", " * debian/patches/df-statfs-fallback.patch: Add a fallback to statfs if the", " mount path could not be found normally (LP: #2116290).", "" ], "package": "rust-coreutils", "version": "0.10.0-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163175, 2134860, 2159679, 2132368, 2137580, 2142900, 2150342, 2157011, 2157342, 2116290 ], "author": "Simon Johnsson ", "date": "Tue, 11 Aug 2026 18:06:43 +0200" }, { "cves": [], "log": [ "", " [ Simon Johnsson ]", " * Remove lld as dependency as it is not available on i386:", " - d/control: Remove Build-Depends lld", " - d/rules: Change RUSTFLAGS to omit lld", " * debian/patches:", " - cp-respect-composite-flag: Cherry-pick fix from upstream for issue", " where the -a flag is not considered recursive due to flag stripping", " (LP: #2158691)", "", " [ Varun Varma ]", " * debian/patches:", " - rustix-use-libc-backend: Switch rustix backend to libc to solve", " the error where tools that rely on LD_PRELOAD have altered", " behaviour with the default rustix backend (LP: #2160614).", "" ], "package": "rust-coreutils", "version": "0.9.0-2ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2158691, 2160614 ], "author": "Simon Johnsson ", "date": "Tue, 14 Jul 2026 17:15:36 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes: (LP: #2153168)", " - Install libstdbuf.so", " - Install hardlinks", " - Refresh upstream patches", " - Use direct GitHub tarball instead of debian/repack.sh", " - d/rules:", " + Add vendoring targets", " + Build verbosely", " + Skip failing tests", " - d/watch: add watch file", " - d/patches:", " + Tweak-release-build-profile.patch", " + workspace-exclude.patch", " + build-stty.patch", " + require-utility-to-be-invoked-at-matching-path.patch", " + glibc-2.42.patch", " + dd-ensure-full-writes.patch", " + use-l10n-translations-in-makefile.patch", " + fix-locale-path.patch", " + fix-incomplete-locale-bundles.patch", " - d/control: update XS-Vendored-Sources-Rust field", " - vendor: update vendored deps", " - l10n/: update translations", " * Fixes:", " - xattrs break ls formatting (LP: #2154338)", " - ls: files are not sorted in alphabetical order when using", " --group-directories-first or if LC_ALL is unset (LP: #2154042)", " * Drop changes:", " - d/p/tee-fix-input-with-sleep.patch: The underlying issue was fixed", " upstream, so drop the patch.", " * New changes:", " - Enable feat_systemd_logind to fix who not showing output", " (LP: #2152801, LP: #2146819, LP: #2146818)", " + d/control: Add libsystemd-dev as a dependency.", " + d/rules: Link systemd and add feat_systemd_logind to CARGOFLAGS.", " - d/p/fix-cp-parents.patch: Cherry-pick fix from upstream for cp --parents", " bug resulting in build failures (LP: #2155763)", " - Remove unnecessary upstream patches:", " + disable-utmp-classic.diff", " + fix-locale-path.diff: Locale handling is different on Ubuntu, using", " l10n (see the new fix-locale-path.patch).", " + fix-man.diff: Uncommented in the upstream series.", " + fix-ppc64el-baudrate.diff: Launchpad's builders instead fails on", " ppc64le for this patch, the original source code is correct.", " + use-vendor.diff: Vendor handling is different on Ubuntu.", " - Remove docs/tldr.zip from Debian upstream", " - Delete locales shipped in Debian upstream under src/", " - Move vendored dependencies to debian/", "" ], "package": "rust-coreutils", "version": "0.9.0-2ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153168, 2154338, 2154042, 2152801, 2146819, 2146818, 2155763 ], "author": "Simon Johnsson ", "date": "Thu, 04 Jun 2026 15:54:29 +0200" }, { "cves": [], "log": [ "", " * d/p/fix-incomplete-locale-bundles.patch: Fix an error where messages did", " not fallback to embedded locales correctly if utility-specific locales", " were missing. This lead to tests failing that expected translated", " messages but received the raw Fluent key instead.", "" ], "package": "rust-coreutils", "version": "0.8.0-0ubuntu3", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Simon Johnsson ", "date": "Thu, 16 Apr 2026 14:41:19 +0200" }, { "cves": [], "log": [ "", " * d/p/tee-fix-input-with-sleep.patch: Fix an error where tee prematurely", " exits causing a SIGPIPE/EPIPE. This happened when the first read() returns", " fewer than 8 KiB, causing the upstream process in a pipeline to receive", " SIGPIPE/EPIPE and fail.", "" ], "package": "rust-coreutils", "version": "0.8.0-0ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Simon Johnsson ", "date": "Wed, 15 Apr 2026 11:21:14 +0200" }, { "cves": [], "log": [ "", " * New upstream version (LP: #2147425)", " * Drop patch:", " - use-u32-for-ppc64le.patch: Added upstream.", " * Refresh patches:", " - Tweak-release-build-profile.patch", " - build-stty.patch", " - dd-ensure-full-writes.patch", " - glibc-2.42.patch", " - require-utilities-to-be-invoked-using-matching-path.patch", " - use-l10n-translations-in-makefile.patch", " - workspace-exclude.patch", " * Add patches:", " - fix-locale-path.patch: Use a specific known directory for locale", " lookup. This also installs locales in /usr/share/coreutils/locales", " instead of /usr/share/locales/.", "" ], "package": "rust-coreutils", "version": "0.8.0-0ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2147425 ], "author": "Simon Johnsson ", "date": "Tue, 07 Apr 2026 12:34:13 +0200" }, { "cves": [], "log": [ "", " * New upstream version 0.7.0 (LP: #2143711)", " * Fixes:", " - `man 1 test` is badly formated (LP: #2115782)", " - cp -r /dev/urandom copies content (LP: #2125263)", " - date: gnu date allows options after format (LP: #2142588)", " - autopkgtest failures in resolute due to readlink (LP: #2141441)", " * Refresh patches:", " - Tweak-release-build-profile.patch", " - dd-ensure-full-writes.patch", " - require-utilities-to-be-invoked-using-matching-path.patch", " - use-l10n-translations-in-makefile.patch", " - workspace-exclude.patch", " * Drop patches:", " - prevent-stty-termios2-on-ppc64el.patch: Fixed upstream.", " * Add patches:", " - use-u32-for-ppc64le.patch: Fix type assumption for ppc64 little-endian.", " This relates to the previous dropped patch about termios2, but upstream", " did not treat little- and big-endian ppc64 differently.", "" ], "package": "rust-coreutils", "version": "0.7.0-0ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2143711, 2115782, 2125263, 2142588, 2141441 ], "author": "Simon Johnsson ", "date": "Mon, 09 Mar 2026 11:33:48 +0100" }, { "cves": [], "log": [ "", " * New usptream version (LP: #2139697)", " * Fixes:", " - comm does not work as expected with process substitution (LP: #2138315)", " - git: FTBFS in Resolute (LP: #2138217)", " - tee with multiple --append fails in rust corutils (LP: #2134578)", " - echo 1 | sort | head -n0: sort: write failed: 'standard output':", " Broken pipe (LP: #2133156)", " - env: Rust unwrap with UTF-8 symbols in environment variables", " (LP: #2132941)", " - \"du\" is double-counting hard links when multiple arguments specified", " (LP: #2132245)", " - dd: O_DIRECT partial block writes fail (LP: #2132150)", " - date does not support localized output (LP: #2130859)", " - SSH sessions blocked on unavailable automounts by default in Ubuntu 25.10", " (LP: #2130843)", " - rust-coreutils 'shred' refuses to write to a device (LP: #2130396)", " - rust-coreutils stats handling breaks wireguard's wg-quick (LP: #2127851)", " - rust-coreutils:dd: Broken pipe (LP: #2125943)", " - /usr/bin/sort: -k option does not behave as GNU's sort (LP: #2125504)", " - uutils wc crashed with SIGABRT on logout (LP: #2122166)", " - who, pinky are empty - need to talk to logind (LP: #2117771)", " * Drop applied patches:", " - use-mem-zeroed.diff: The timespec C-binding struct has been replaced", " by the safe abstraction nix::sys::time::TimeSpec. Padding should now", " be handled internally for 32-bit architectures.", " * Refresh patches:", " - Tweak-release-build-profile.patch", " - build-stty.patch", " - dd-ensure-full-writes.patch", " - fix-prefix.diff", " - glibc-2.42.patch", " - require-utilities-to-be-invoked-using-matching-path.patch", " - use-l10n-translations-in-makefile.patch", " - workspace-exclude.patch", " * Add patch:", " - prevent-stty-termios2-on-ppc64el.patch: The termios2 header is not", " always available or exposed on ppc64el systems. Use the standard termios", " interface instead to avoid build failures on such systems.", " * Skip failing tests:", " (s390x)", " - test_env::test_simulation_of_terminal_for_stdout_only", " - test_nohup::test_nohup_stderr_to_stdout", " - test_nohup::test_nohup_with_pseudo_terminal_emulation_on_stdin_stdout_stderr_get_replaced", " - test_touch::test_touch_changes_time_of_file_in_stdout", " (amd64v3)", " - test_dd::test_stdin_stdout_skip_w_multiplier", " * Re-enable previously failing tests:", " - test_chown::test_chown_only_group_id_nonexistent_group", " - test_chown::test_chown_only_user_id_nonexistent_user", " - test_expr::test_long_input", " - test_factor::test_parallel", " - test_install::test_install_and_strip", " - test_install::test_install_and_strip_with_program", " - test_ls::test_device_number", " - test_ls::test_localized_possible_values", " - test_od::test_od_options_after_filename", " - test_od::test_suppress_duplicates", " - test_sort::", " + test_argument_suggestion", " + test_clap_localization_help_message", " + test_clap_localization_invalid_value", " + test_clap_localization_unknown_argument", " + test_error_colors_disabled", " + test_error_colors_enabled", " + test_french_translations", " + test_help_colors_disabled", " + test_help_colors_enabled", " - test_stat::", " + test_mount_point_basic", " + test_mount_point_combined_with_other_specifiers", " + test_multi_files", " + test_normal_format", " + test_printf", " + test_symlinks", " + test_terse_fs_format", " - test_error_messages_french_translation", " - test_french_colored_error_messages", " - test_help_messages_french_translation", " - util_invalid_name_invalid_command", "" ], "package": "rust-coreutils", "version": "0.6.0-0ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2139697, 2138315, 2138217, 2134578, 2133156, 2132941, 2132245, 2132150, 2130859, 2130843, 2130396, 2127851, 2125943, 2125504, 2122166, 2117771 ], "author": "Simon Johnsson ", "date": "Tue, 03 Feb 2026 17:53:04 +0100" }, { "cves": [], "log": [ "", " * Add and install l10n translation files.", "" ], "package": "rust-coreutils", "version": "0.5.0-0ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Simon Johnsson ", "date": "Fri, 30 Jan 2026 14:33:41 +0100" }, { "cves": [], "log": [ "", " * New upstream release (LP: #2138304)", " * Change applied patches:", " - Tweak-release-build-profile: Remove panic = \"abort\"", " in Cargo.toml as it is already set by default.", " - workspace-exclude: Remove tests/benches as it no", " longer exists upstream.", " * Skip failing 0.5.0 tests (LP: #2138377)", " * Enable passing 0.5.0 tests", "" ], "package": "rust-coreutils", "version": "0.5.0-0ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2138304, 2138377 ], "author": "Simon Johnsson ", "date": "Mon, 12 Jan 2026 15:23:49 +0100" }, { "cves": [], "log": [ "", " * Skip failing 0.3.0 tests", " https://github.com/uutils/coreutils/issues/9017", "" ], "package": "rust-coreutils", "version": "0.3.0-0ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Sat, 25 Oct 2025 15:23:12 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", " * Drop applied patches:", " - date: use reference file (LP: #2127970)", " - id: Implement no-op `-a` option (LP: #2125578)", "" ], "package": "rust-coreutils", "version": "0.3.0-0ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2127970, 2125578 ], "author": "Julian Andres Klode ", "date": "Sat, 25 Oct 2025 15:13:36 +0200" }, { "cves": [], "log": [ "", " * Cherry pick fixes from pull requests", " - date: use reference file (LP: #2127970)", " - dd: ensure full writes (LP: #2125535)", "" ], "package": "rust-coreutils", "version": "0.2.2-0ubuntu4", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [ 2127970, 2125535 ], "author": "Julian Andres Klode ", "date": "Wed, 22 Oct 2025 12:39:11 +0200" }, { "cves": [], "log": [ "", " * id: Implement no-op `-a` option (LP: #2125578)", "" ], "package": "rust-coreutils", "version": "0.2.2-0ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2125578 ], "author": "Julian Andres Klode ", "date": "Wed, 24 Sep 2025 17:36:56 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "rust-coreutils", "version": "0.2.2-0ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 23 Sep 2025 17:17:36 +0200" }, { "cves": [], "log": [ "", " * stty: avoid panic when not attached to a tty.", " This was causing additional stderr output in tests using", " xvfb-run, causing the tests to fail.", " (The *command* itself was failing regardless, but the failure", " case here is that the shell printed the \"Aborted (core dumped)\"", " messages)", " * Cherry-pick https://github.com/uutils/coreutils/pull/8565", " * Refresh 8565 to make it a \"proper\" patch that only patches each file once", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu7", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 09 Sep 2025 18:54:54 +0200" }, { "cves": [], "log": [ "", " * Handle speed_t changes in glibc 2.42 (LP: #2121635)", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu6", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2121635 ], "author": "Julian Andres Klode ", "date": "Thu, 04 Sep 2025 23:32:09 +0200" }, { "cves": [], "log": [ "", " * Require utilities to be invoked using matching path.", " Ensure that argv[0] if it is a utility name matches /proc/self/exe", " if /proc/self/exe exists. This allows AppArmor transitions to have", " reasonable effect; for example transitioning to unconfined ls cannot", " inadvertently run `rm` code.", " * Conflict with coreutils-from-uutils that linked to /usr/bin/coreutils.", " Symlinks to /usr/bin/coreutils no longer work in the new scheme,", " so we need a versioned Conflicts to force the symlinks to be", " updated first *before* we unpack the new enforcing rust-coreutils", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu5", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 04 Sep 2025 22:17:05 +0200" }, { "cves": [], "log": [ "", " * Revert \"Use Rust 1.85 for building\", it is the default now", " * Use hardlinks in /usr/lib/cargo/bin instead of symlinks, this allows", " the next upload to enforce that argv[0] matches the executable name,", " such that an AppArmor profile allowing \"ls\" cannot be tricked into", " executing rm code by running \"ls\" with argv being {\"rm\", \"...\"}", " * Build verbosely", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu4", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 04 Sep 2025 12:34:06 +0200" }, { "cves": [], "log": [ "", " * d/rules: Disable some more broken tests.", " These depend on the host's rust-coreutils, disable them for", " now. Forwarded upstream.", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 26 Aug 2025 21:15:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250813.4af2a84-0ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Thu, 14 Aug 2025 16:00:22 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", " - Fixes env(1) forks, but must exec() directly (LP: #2112491)", " - Fixes cat: f.gz: EPIPE: Broken pipe (LP: #2115033)", " - Fixes date parsing does not support sub-second precision (LP: #2111603)", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250801.cf79675-0ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2112491, 2115033, 2111603 ], "author": "Julian Andres Klode ", "date": "Fri, 01 Aug 2025 17:10:13 +0200" }, { "cves": [], "log": [ "", " * Cherry pick mknod --mode fix (LP: #2116973)", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250711.2ba3a33-0ubuntu4", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2116973 ], "author": "Julian Andres Klode ", "date": "Tue, 29 Jul 2025 18:40:35 +0200" }, { "cves": [], "log": [ "", " * install-Fix-no-target-directory-with-existing-file.patch: Cherry pick", " my pull request to fix --no-target-directory with existing target file", " (LP: #2118785)", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250711.2ba3a33-0ubuntu3", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2118785 ], "author": "Julian Andres Klode ", "date": "Tue, 29 Jul 2025 12:17:51 +0200" }, { "cves": [], "log": [ "", " * d/b/install-mkdir-Handle-dir-.-like-dir.patch: Handle dir/./ like dir/.", " (LP: #2117466)", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250711.2ba3a33-0ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2117466 ], "author": "Julian Andres Klode ", "date": "Tue, 22 Jul 2025 09:48:08 +0200" }, { "cves": [], "log": [ "", " * New upstream git commit 0.1.0+git20250711.2ba3a33", " - Fix 'od' invalid handling of non ascii chars (LP: #2114827)", " - Fix `cp -a` fails to copy symlink to directory (LP: #2116859)", " - Fix dpkg-source fails to unpack broken symlink (LP: #2116886)", " - Fix Incorrect evaluation of expr (LP: #2112445)", " - Fix cat doesn't handle EPERM (LP: #2112552)", " - Fix /bin/stty: invalid argument 'sane' (LP: #2113983)", " - Fix tee is buffered (LP: #2114706)", " - Fix rm of long paths (LP: #2114886)", " - Fix ls doesn't include acl \"+\" info on symlink (LP: #2114887)", " - Fix fold: failed to read line: stream did not contain valid UTF-8", " (LP: #2114970)", " - Fix gpgrt-config invalid output due to rust-coreutils \"expr\"", " (LP: #2115147)", " - Fix `cp --no-dereference --parents` where source is a symlink to", " a directory (LP: #2116572)", " - Internationalization and French translations for a lot of stuff", " * Install locales", " * d/patches/Setup-localization-for-utility-symlinks.patch: Setup the", " localization when invoked via symlinks", "" ], "package": "rust-coreutils", "version": "0.1.0+git20250711.2ba3a33-0ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2114827, 2116859, 2116886, 2112445, 2112552, 2113983, 2114706, 2114886, 2114887, 2114970, 2115147, 2116572 ], "author": "Julian Andres Klode ", "date": "Mon, 21 Jul 2025 12:48:46 +0200" }, { "cves": [], "log": [ "", " * New upstream release.", " - Add the -Z,--context options (LP: #2110910)", " - Add install -T (LP: #2111714)", " - Improve echo -- handling (LP: #2115196)", " - Fixes chroot in namespace (LP: #2111882)", " - sha256sum and friends now correctly handle * (LP: #2113963)", " - rm: Don't prompt if stdin is not interactive (LP: #2115035)", " * Update vendored dependencies and rebase the patches", " * Use Rust 1.85 for building, a bunch of workarounds are needed right now:", " - Use a vendored copy of the cargo wrapper that hardcodes cargo-1.85", " - Remove the unneeded dh_auto_configure call, this duplicates what we", " already do explictly", " - Switch the build system to makefile, since we actually use the", " makefile buildsystem", "" ], "package": "rust-coreutils", "version": "0.1.0-0ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2110910, 2111714, 2115196, 2111882, 2113963, 2115035 ], "author": "Julian Andres Klode ", "date": "Fri, 04 Jul 2025 13:58:43 +0200" }, { "cves": [], "log": [ "", " * Add missing libselinux1-dev, libclang-dev build dependencies", "" ], "package": "rust-coreutils", "version": "0.0.30-2ubuntu2", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 03 Jun 2025 13:27:37 +0200" }, { "cves": [], "log": [ "", " * Vendor dependencies", " - debian/rules:", " + Add vendoring rules", " + Move the prepare-debian call to override_dh_auto_configure and adjust it", " to use our vendored dependencies", " - debian/patches:", " + Add workspace-exclude.patch to exclude vendored crates from the workspace", " + Drop all the patches to adjust crate versions", " + Drop all the patches to adjust code to different crate versions", " + Drop all the patches to disable certain programs or windows", " dependencies, as we can now", " * Build factor, basenc and install links for them", " * Build stty binary (LP: #2111211)", "" ], "package": "rust-coreutils", "version": "0.0.30-2ubuntu1", "urgency": "medium", "distributions": "questing", "launchpad_bugs_fixed": [ 2111211 ], "author": "Julian Andres Klode ", "date": "Tue, 03 Jun 2025 12:24:02 +0200" } ], "notes": null, "is_version_downgrade": true }, { "name": "software-properties-common", "from_version": { "source_package_name": "software-properties", "source_package_version": "0.122", "version": "0.122" }, "to_version": { "source_package_name": "software-properties", "source_package_version": "0.123", "version": "0.123" }, "cves": [], "launchpad_bugs_fixed": [ 2161023 ], "changes": [ { "cves": [], "log": [ "", " * cloudarchive: Enable support for Hibiscus (2026.2) UCA on Resolute (26.04)", " (LP: #2161023).", "" ], "package": "software-properties", "version": "0.123", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2161023 ], "author": "Himawan Winarto ", "date": "Fri, 04 Sep 2026 13:51:46 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo", "from_version": { "source_package_name": "sudo", "source_package_version": "1.9.17p2-7ubuntu3", "version": "1.9.17p2-7ubuntu3" }, "to_version": { "source_package_name": "sudo", "source_package_version": "1.9.17p2-7ubuntu4", "version": "1.9.17p2-7ubuntu4" }, "cves": [ { "cve": "CVE-2026-82474", "url": "https://ubuntu.com/security/CVE-2026-82474", "cve_description": "Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.", "cve_priority": "medium", "cve_public_date": "2026-08-29 17:17:00 UTC" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-82474", "url": "https://ubuntu.com/security/CVE-2026-82474", "cve_description": "Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging.", "cve_priority": "medium", "cve_public_date": "2026-08-29 17:17:00 UTC" } ], "log": [ "", " * SECURITY UPDATE: Policy and Logging Bypass", " - debian/patches/CVE-2026-82474-pre1.patch: resolve /proc/self/fd/N", " pathname in get_execve_info().", " - debian/patches/CVE-2026-82474-pre2.patch: pass correct name to", " proc_read_link().", " - debian/patches/CVE-2026-82474.patch: add intercept and log_subcmds", " support for execveat(2).", " - debian/patches/CVE-2026-82474-2.patch: error out if we run out of", " space rewriting pathname.", " - debian/patches/CVE-2026-82474-3.patch: fix handling of relative paths", " in the execveat(2) intercept support.", " - CVE-2026-82474", "" ], "package": "sudo", "version": "1.9.17p2-7ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "John Breton ", "date": "Mon, 21 Sep 2026 14:37:18 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "sudo-rs", "from_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.14-1ubuntu2", "version": "0.2.14-1ubuntu2" }, "to_version": { "source_package_name": "rust-sudo-rs", "source_package_version": "0.2.14-1ubuntu4", "version": "0.2.14-1ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2167861 ], "changes": [ { "cves": [], "log": [ "", " * Remove execution bit and shebang from Apport hook", "" ], "package": "rust-sudo-rs", "version": "0.2.14-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Benjamin Drung ", "date": "Tue, 22 Sep 2026 18:10:24 +0200" }, { "cves": [], "log": [ "", " * d/control: Drop Recommends apport as it was added incorrectly as a result", " of the apport hook (LP: #2167861)", "" ], "package": "rust-sudo-rs", "version": "0.2.14-1ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167861 ], "author": "Simon Johnsson ", "date": "Mon, 21 Sep 2026 17:37:28 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-cryptsetup", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-hwe-hwdb", "from_version": { "source_package_name": "systemd-hwe", "source_package_version": "259.5.3ubuntu", "version": "259.5.3ubuntu" }, "to_version": { "source_package_name": "systemd-hwe", "source_package_version": "261.3.1ubuntu", "version": "261.3.1ubuntu" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * hwdb.d: drop rules now included in src:systemd", "" ], "package": "systemd-hwe", "version": "261.3.1ubuntu", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 10:55:14 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-resolved", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "systemd-sysv", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "tar", "from_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-4", "version": "1.35+dfsg-4" }, "to_version": { "source_package_name": "tar", "source_package_version": "1.35+dfsg-5ubuntu1", "version": "1.35+dfsg-5ubuntu1" }, "cves": [ { "cve": "CVE-2025-45582", "url": "https://ubuntu.com/security/CVE-2025-45582", "cve_description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.", "cve_priority": "medium", "cve_public_date": "2025-07-11 17:15:00 UTC" }, { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" }, { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" }, { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" }, { "cve": "CVE-2025-45582", "url": "https://ubuntu.com/security/CVE-2025-45582", "cve_description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.", "cve_priority": "medium", "cve_public_date": "2025-07-11 17:15:00 UTC" } ], "launchpad_bugs_fixed": [ 2163533, 2160650, 2161311 ], "changes": [ { "cves": [ { "cve": "CVE-2025-45582", "url": "https://ubuntu.com/security/CVE-2025-45582", "cve_description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.", "cve_priority": "medium", "cve_public_date": "2025-07-11 17:15:00 UTC" }, { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " * Merge with Debian unstable. (LP: #2163533) Remaining changes:", " - d/patches:", " + SECURITY UPDATE: File overwrite via directory traversal", " - debian/patches/CVE-2025-45582-*.patch: Backport openat2 support in order", " to jailify the extraction directory.", " - Addresses CVE-2025-45582", " + SECURITY UPDATE: file injection via crafted archive", " - debian/patches/CVE-2026-5704.patch: always call skip_member() after", " extraction in src/extract.c, fix skim_member() to skip directory data", " in src/list.c, remove conditional skip_member() call from", " purge_directory in src/incremen.c", " - debian/patches/CVE-2026-5704-*.patch: address a regression that makes", " valid files not extract in src/list.c, tests/Makefile.am,", " tests/extrac32.at, tests/extrac34.at, test/testsuite.at, src/extract.c,", " tests/extract23, tests/extrac30.at.", " - debian/patches/CVE-2026-5704-5.patch: fix \"Old archives with nonzero", " directory sizes failing to be extracted\" by forcing the size to zero", " afor DIRTYPE in read_header() in src/list.c", " - Addresses CVE-2026-5704", " * New changes:", " - d/patches:", " + Fix d/p/0001 line markers", "" ], "package": "tar", "version": "1.35+dfsg-5ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163533 ], "author": "Pierre-Elliott Bécue ", "date": "Tue, 18 Aug 2026 19:58:00 +0200" }, { "cves": [], "log": [ "", " * Team upload (salsa.debian.org/debian namespace)", " * Add libacl FTBFS fix from bug-tar mailing list (Closes: #1141146)", " * Slight tweak of upstream patch to apply cleanly to 1.35", "" ], "package": "tar", "version": "1.35+dfsg-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Simon Josefsson ", "date": "Sat, 01 Aug 2026 14:00:00 +0200" }, { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" } ], "log": [ "", " [ Leonidas Da Silva Barbosa ]", " * SECURITY REGRESSION: Extract files issue", " - debian/patches/CVE-2026-5704-*.patch: address a regression", " that makes valid files not extract in src/list.c,", " tests/Makefile.am, tests/extrac32.at, tests/extrac34.at,", " test/testsuite.at, src/extract.c, tests/extract23,", " tests/extrac30.at (LP: #2160650).", " * SECURITY REGRESSION: Old archives with nonzero directory sizes", " failing to be extracted", " - debian/patches/CVE-2026-5704-5.patch: fix this by forcing", " the size to zero for DIRTYPE in read_header() in src/list.c", " (LP: #2161311)", "" ], "package": "tar", "version": "1.35+dfsg-4ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2160650, 2161311 ], "author": "Marc Deslauriers ", "date": "Mon, 27 Jul 2026 12:58:33 -0400" }, { "cves": [ { "cve": "CVE-2026-5704", "url": "https://ubuntu.com/security/CVE-2026-5704", "cve_description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.", "cve_priority": "medium", "cve_public_date": "2026-04-06 16:16:00 UTC" }, { "cve": "CVE-2025-45582", "url": "https://ubuntu.com/security/CVE-2025-45582", "cve_description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.", "cve_priority": "medium", "cve_public_date": "2025-07-11 17:15:00 UTC" } ], "log": [ "", " [ Leonidas Da Silva Barbosa ]", " * SECURITY UPDATE: file injection via crafted archive", " - debian/patches/CVE-2026-5704.patch: always call skip_member() after", " extraction in src/extract.c, fix skim_member() to skip directory data", " in src/list.c, remove conditional skip_member() call from", " purge_directory in src/incremen.c", " - CVE-2026-5704", "", " [ Marc Deslauriers ]", " * SECURITY UPDATE: File overwrite via directory traversal", " - debian/patches/CVE-2025-45582-*.patch: Backport openat2 support in", " order to jailify the extraction directory.", " - CVE-2025-45582", "" ], "package": "tar", "version": "1.35+dfsg-4ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Mon, 29 Jun 2026 07:52:01 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "tzdata", "from_version": { "source_package_name": "tzdata", "source_package_version": "2026c-1ubuntu1", "version": "2026c-1ubuntu1" }, "to_version": { "source_package_name": "tzdata", "source_package_version": "2026e-1ubuntu1", "version": "2026e-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2169125 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2169125). Remaining changes:", " - Ship 2026c ICU timezone data which are utilized by PHP in tzdata-icu", " - Add autopkgtest test case for ICU timezone data", " - Point Vcs-Browser/Git to Launchpad", " * Update the ICU timezone data to 2026e", " * Add autopkgtest test case for ICU timezone data 2026d and 2026e", "" ], "package": "tzdata", "version": "2026e-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169125 ], "author": "Benjamin Drung ", "date": "Fri, 02 Oct 2026 13:21:30 +0200" }, { "cves": [], "log": [ "", " * New upstream version 2026d:", " - Canada’s Northwest Territories moved to permanent -06 on 2026-08-21 and", " will not fall back from -06 to -07 on 2026-11-01", " * New upstream version 2026e:", " - Manitoba moves to permanent -05 on 2026-10-31 and will not fall back", " from -05 to -06 on 2026-11-01", " * Add autopkgtest test cases for 2026d and 2026e releases", " * Revert POSIX conformance of old SysV names EST5EDT, CST6CDT, MST7MDT and", " PST8PDT", " * Bump debhelper compatibility to 14", "" ], "package": "tzdata", "version": "2026e-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Wed, 30 Sep 2026 21:01:06 +0000" } ], "notes": null, "is_version_downgrade": false }, { "name": "ubuntu-release-upgrader-core", "from_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.9", "version": "1:26.10.9" }, "to_version": { "source_package_name": "ubuntu-release-upgrader", "source_package_version": "1:26.10.10", "version": "1:26.10.10" }, "cves": [], "launchpad_bugs_fixed": [ 2167515, 2167516 ], "changes": [ { "cves": [], "log": [ "", " * DistUpgradeCache: allow openssh-server to be removed despite being in", " the removal denylist when openssh-server-gssapi, which replaces it, is", " being installed or upgraded in the same transaction (LP: #2167515)", " * DistUpgradeQuirks: detect systems using openssh with GSSAPI and select", " the openssh-server-gssapi and/or openssh-client-gssapi variants instead", " of the base packages when upgrading to 26.10 or later (LP: #2167516)", "" ], "package": "ubuntu-release-upgrader", "version": "1:26.10.10", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167515, 2167516 ], "author": "Andreas Hasenack ", "date": "Sun, 20 Sep 2026 16:56:27 -0300" } ], "notes": null, "is_version_downgrade": false }, { "name": "udev", "from_version": { "source_package_name": "systemd", "source_package_version": "261.2-1ubuntu1", "version": "261.2-1ubuntu1" }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316, 2142900, 2153836, 2147513, 2153937 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" }, { "cves": [], "log": [ "", " * Drop test-use-gnuenv-to-workaround-broken-block-signal.patch.", " Fixed in rust-coreutils (LP: #2142900)", " * mkosi: explicitly add mount package to initrd image", " * d/systemd.links: stop creating cryptdisks{,-early}.service masks (LP: #2153836)", " * d/extra: stop setting ForwardToSyslog=yes by default (LP: #2147513)", " Modern syslog implementations should read from the journal directly.", " * test: run more tests in VMs", " * d/systemd.links: drop unnecessary x11-common.service mask (LP: #2153937)", "" ], "package": "systemd", "version": "261.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2142900, 2153836, 2147513, 2153937 ], "author": "Nick Rosbrook ", "date": "Thu, 10 Sep 2026 13:29:41 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "update-notifier-common", "from_version": { "source_package_name": "update-notifier", "source_package_version": "3.212", "version": "3.212" }, "to_version": { "source_package_name": "update-notifier", "source_package_version": "3.213", "version": "3.213" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Import new translations from launchpad", "" ], "package": "update-notifier", "version": "3.213", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Alessandro Astone ", "date": "Thu, 01 Oct 2026 19:54:44 +0200" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "util-linux-extra", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false }, { "name": "uuid-runtime", "from_version": { "source_package_name": "util-linux", "source_package_version": "2.41.3-3ubuntu2", "version": "2.41.3-3ubuntu2" }, "to_version": { "source_package_name": "util-linux", "source_package_version": "2.42.2-1ubuntu2", "version": "2.42.2-1ubuntu2" }, "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" }, { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2166882, 2153369, 2125968 ], "changes": [ { "cves": [], "log": [ "", " * d/p/ubuntu/libmount-restricted-live-creds.patch: restore live-credential", " check for libmount restricted mode (LP: #2166882)", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166882 ], "author": "Nadzeya Hutsko ", "date": "Wed, 16 Sep 2026 19:36:33 +0200" }, { "cves": [], "log": [ "", " * Merge with Debian unstable (LP: #2153369).", " Added changes:", " - tests/fincore: force the use of GNU dd over uutils (LP: #2125968)", " Remaining changes:", " - Add sulogin-fallback-static-sh.patch", " Add support for /bin/static-sh as fallback if the regular shell fails to", " execute. Patch ported from sysvinit. (see LP #505887)", " - Add sulogin-lockedpwd.patch", " Make sure file systems can be fixed on machines with locked root", " accounts (as Ubuntu does by default). Don't require --force for sulogin.", " - d/rules: disable libmount mountfs support", " Disable brand new feature with --disable-libmount-mountfd-support that", " causes inability to deploy MAAS LP #2037417.", " - d/p/ubuntu/su-pty-drop-caps.patch: harden 'su --pty' to temporarily lower", " capabilities while proxying between stdin/stdout and the pty master. This", " is to avoid su from being used to exploit kernel vulnerabilities.", "" ], "package": "util-linux", "version": "2.42.2-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2153369, 2125968 ], "author": "Florent 'Skia' Jacquet ", "date": "Fri, 26 Jun 2026 12:03:00 +0200" }, { "cves": [ { "cve": "CVE-2026-53612", "url": "https://ubuntu.com/security/CVE-2026-53612", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) hook_owner.c chmod/chown]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53613", "url": "https://ubuntu.com/security/CVE-2026-53613", "cve_description": "[Local Privilege Escalation via TOCTOU in mount(8) - Target Path Redirection]", "cve_priority": "medium", "cve_public_date": "2026-06-18" }, { "cve": "CVE-2026-53614", "url": "https://ubuntu.com/security/CVE-2026-53614", "cve_description": "[Local Privilege Escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec Bypass in SUID mount(8)]", "cve_priority": "medium", "cve_public_date": "2026-06-18" } ], "log": [ "", " * New upstream version, fixing security issues", " CVE-2026-53612, CVE-2026-53613, CVE-2026-53614 (Closes: #1140194,", " #1140195, #1140196)", " * Drop upstream-applied patch.", "" ], "package": "util-linux", "version": "2.42.2-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 17 Jun 2026 11:20:49 +0200" }, { "cves": [], "log": [ "", " * Follow debhelper 14.1, thus putting PAM files back into /etc/pam.d.", " Note that include=login is still undesirable, and packages should", " include common-* instead.", "" ], "package": "util-linux", "version": "2.42.1-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 16 Jun 2026 22:26:25 +0200" }, { "cves": [], "log": [ "", " * PAM config: stop using include.", " Avoid including our own PAM config files, as a workaround until PAM can", " include files from /usr/lib/pam.d.", " Should make su -(l) and runuser -l work again. See #1140029.", "" ], "package": "util-linux", "version": "2.42.1-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 15 Jun 2026 19:34:54 +0200" }, { "cves": [], "log": [ "", " * Update debhelper-compat to v14.", " Remove dh-sequence-installsysusers, remove ${misc:Pre-Depends} from", " Pre-Depends. PAM /etc/pam.d files are replaced by files in", " /usr/lib/pam.d.", "" ], "package": "util-linux", "version": "2.42.1-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 14 Jun 2026 17:28:35 +0200" }, { "cves": [], "log": [ "", " * Use upstream patch to fix FTBFS on systems with non-4K pagesizes", " (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Mon, 08 Jun 2026 15:05:17 +0200" }, { "cves": [], "log": [ "", " * Fix FTBFS on systems with non-4K pagesizes (Closes: #1138789)", "" ], "package": "util-linux", "version": "2.42.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 04 Jun 2026 13:31:17 +0200" }, { "cves": [], "log": [ "", " * New upstream version", " * Refresh/drop upstream applied patches", "", " [ Karel Zak ]", " * script: fix backward compatibility for options after non-option args", " * script: fix \"--\" separator when used as option argument", " (Closes: #1132887)", "" ], "package": "util-linux", "version": "2.42.1-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 03 Jun 2026 20:12:19 +0200" }, { "cves": [], "log": [ "", " * Stop using Linux crypto API in hardlink(1)", "" ], "package": "util-linux", "version": "2.42-6", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 06 May 2026 20:41:22 +0200" }, { "cves": [], "log": [ "", " * Remove leftover /etc/init.d/uuidd conffile", "" ], "package": "util-linux", "version": "2.42-5", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 26 Apr 2026 14:49:42 +0200" }, { "cves": [], "log": [ "", " * Apply upstream revert of su breakage", " (Closes: #1133379, #1132588, #1132610)", "" ], "package": "util-linux", "version": "2.42-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 19 Apr 2026 17:36:56 +0200" }, { "cves": [], "log": [ "", " * Stop pulling deb_systemdsystemunitdir from pkg-config", " * Stop installing uuidd init script", " * Clarify /bin/login situation on Hurd", " * Install bash-completions using normal dh_install mechanism", " * Install more localized man pages", " * Simplify installing into udebs", " * Install lintian overrides into udebs", " * Run a second build without libsystemd for d-i.", " This is not great, but I see no other option at this time.", " Let's hope a libsystemd0-udeb will appear. (Closes: #1132561)", " * util-linux-extra: install copyfilerange, getino", " * Update lintian overrides", " * Update dependency libselinux1-dev to libselinux-dev", "" ], "package": "util-linux", "version": "2.42-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 12 Apr 2026 00:03:33 +0200" }, { "cves": [], "log": [ "", " * Add upstream patches addressing #1132887", "" ], "package": "util-linux", "version": "2.42-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Wed, 08 Apr 2026 18:28:21 +0200" }, { "cves": [ { "cve": "CVE-2026-27456", "url": "https://ubuntu.com/security/CVE-2026-27456", "cve_description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "cve_priority": "medium", "cve_public_date": "2026-04-03 22:16:00 UTC" } ], "log": [ "", " * New upstream release, fixing CVE-2026-27456 and a CWE-190.", " * Upload to unstable.", "" ], "package": "util-linux", "version": "2.42-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 02 Apr 2026 15:19:42 +0200" }, { "cves": [], "log": [ "", " * New upstream release candidate.", " * Refresh patches", "" ], "package": "util-linux", "version": "2.42~rc2-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Thu, 26 Mar 2026 15:05:59 +0100" }, { "cves": [], "log": [ "", " * Apply upstream patches", " * Fixes unshare issue", " * Use Hurd patches directly from upstream", "" ], "package": "util-linux", "version": "2.42~rc1-3", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sun, 22 Mar 2026 15:20:19 +0100" }, { "cves": [], "log": [ "", " * Fix lsmem tests on loong64.", " Using patch from https://github.com/util-linux/util-linux/pull/4090", " * autopkgtests: switch to pkgconf", "", " [ Samuel Thibault ]", " * Fix build on Hurd", "" ], "package": "util-linux", "version": "2.42~rc1-2", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Tue, 03 Mar 2026 12:43:24 +0100" }, { "cves": [ { "cve": "CVE-2026-3184", "url": "https://ubuntu.com/security/CVE-2026-3184", "cve_description": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.", "cve_priority": "medium", "cve_public_date": "2026-04-03 19:17:00 UTC" } ], "log": [ "", " * New upstream release candidate.", " * includes fix for CVE-2026-3184:", " * login: use original FQDN for PAM_RHOST", " * libuuid: reset initial cont-clock time on service start (Closes:", " #1126894)", " * Symbols: use (symver) and update lists", " * Stop installing untranslated man pages", "" ], "package": "util-linux", "version": "2.42~rc1-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 28 Feb 2026 20:37:48 +0100" }, { "cves": [], "log": [ "", " [ Chris Hofstaedtler ]", " * Follow libselinux1-dev to libselinux-dev rename (Closes: #1124751)", " * uuid-runtime: stop removing /var/run/uuidd on purge", " /run is a tmpfs, it will be cleaned up anyway. Lets us drop the postrm", " maintscript.", "", " [ Luca Boccassi ]", " * uuid-runtime: drop manual scripting in postinst and rely on sysusers.d", "" ], "package": "util-linux", "version": "2.41.3-4", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Chris Hofstaedtler ", "date": "Sat, 21 Feb 2026 17:15:50 +0100" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [ { "name": "bpfcc-tools", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "bpfcc", "source_package_version": "0.35.0+ds-1ubuntu4", "version": "0.35.0+ds-1ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2166528 ], "changes": [ { "cves": [], "log": [ "", " * d/p/git-fix-llvm22.patch: add support for LLVM 22 (LP: #2166528)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166528 ], "author": "Karl Smeltzer ", "date": "Fri, 04 Sep 2026 11:14:31 -0700" }, { "cves": [], "log": [ "", " * No-change rebuild for llvm-defaults (now version 22)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Karl Smeltzer ", "date": "Thu, 03 Sep 2026 16:00:07 -0400" }, { "cves": [], "log": [ "", " * No-change rebuild to build with LLVM 21 on amd64v3.", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 16 Mar 2026 12:30:24 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "bpftrace", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "bpftrace", "source_package_version": "0.25.0-1ubuntu2", "version": "0.25.0-1ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * No-change rebuild for llvm-defaults (now version 22)", "" ], "package": "bpftrace", "version": "0.25.0-1ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Karl Smeltzer ", "date": "Wed, 16 Sep 2026 08:15:13 -0400" }, { "cves": [], "log": [ "", " * Merge with Debian; remaining changes:", " - Enable the testsuite (LP #2052809)", " The testsuite is only enabled for autopkgtest, not at build time.", " This adds one build dependency: pahole, needed to build the tests.", " - Add symbol dumps for bpftrace and bpftrace-aotrt", " + d/helpers/dump_debug_symbols.sh: a shell script", " to be used in d/rules to dump the debug symbols of bpftrace", " and bpftrace-aotrt.", " + d/rules: uses the shell script created by the above patch to", " dump the debug symbols, which was not happening earlier due to", " exclusion from dh_strip and custom strip commands.", " (LP #2069953)", " - debian/patches/disable-armhf.patch:", " Comment out some tests failing to build on armhf", " - debian/patches/disable_failing_tests.patch", " debian/tests/control", " Disable some failing tests to have the whole testsuite passing.", " - d/control: Build-Depends: bpftool (LP #2139018)", "" ], "package": "bpftrace", "version": "0.25.0-1ubuntu1", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Sun, 15 Mar 2026 17:32:29 +0100" }, { "cves": [], "log": [ "", " * New upstream release.", " * d/patches: remove patches applied upstream.", " * d/rules: use system libbpf.", "" ], "package": "bpftrace", "version": "0.25.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Vincent Bernat ", "date": "Sun, 15 Mar 2026 00:19:50 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "ieee-data", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "ieee-data", "source_package_version": "20260625", "version": "20260625" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Update all files from ieee", "" ], "package": "ieee-data", "version": "20260625", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Thu, 25 Jun 2026 18:47:50 -0700" }, { "cves": [], "log": [ "", " * Team upload.", " * Update all files from ieee", "", " [ Debian Janitor ]", " * Remove constraints unnecessary since buster:", " + Remove 1 maintscript entries from 1 files.", "" ], "package": "ieee-data", "version": "20240722", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Leonardo Gonçalves Machado ", "date": "Mon, 22 Jul 2024 10:25:21 -0300" }, { "cves": [], "log": [ "", " [ Ileana Dumitrescu ]", " * update-ieee-data: Update URLs (Closes: #1004709)", " * d/control:", " - Standards-Version updated to 4.6.1", " - Updated to dh-compat version 13", "", " [ Samuel Henrique ]", " * Update all files from ieee", " * update-ieee-data:", " - Use https to download files", " - Switch from tempfile to mktemp, as per deprecation notice", " - Switch from echo to printf, to avoid bashism when printing \\t", " - Fix shellcheck findings and use 'command -v' instead of 'which'", " - Update copyright notice", " * d/control: Set Rules-Requires-Root: no", " * d/copyright: Update file", " * wrap-and-sort -a", "" ], "package": "ieee-data", "version": "20220827.1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Samuel Henrique ", "date": "Sat, 27 Aug 2022 21:16:50 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libbpfcc", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "bpfcc", "source_package_version": "0.35.0+ds-1ubuntu4", "version": "0.35.0+ds-1ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2166528 ], "changes": [ { "cves": [], "log": [ "", " * d/p/git-fix-llvm22.patch: add support for LLVM 22 (LP: #2166528)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166528 ], "author": "Karl Smeltzer ", "date": "Fri, 04 Sep 2026 11:14:31 -0700" }, { "cves": [], "log": [ "", " * No-change rebuild for llvm-defaults (now version 22)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Karl Smeltzer ", "date": "Thu, 03 Sep 2026 16:00:07 -0400" }, { "cves": [], "log": [ "", " * No-change rebuild to build with LLVM 21 on amd64v3.", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 16 Mar 2026 12:30:24 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libc-dev-bin", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163528 ], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * Merge from Debian experimental (LP: #2163528)", " Delta dropped:", " - Revert \"debian/rules.d/build.mk: add a makefile function to filter out", " dpkg build flags incompatible with glibc and define CFLAGS from dpkg", " build flags. Closes: #1129746.\"", " - fix ftbfs: backport OPEN_TREE conditional define (LP #2145679)", " [fixed upstream in 2.44]", " - debian/patches/CVE-2026-4046.patch", " [fixed in 2.43-3]", " - debian/patches/CVE-2026-5435.patch", " [fixed in 2.43-3]", " - debian/patches/CVE-2026-5450.patch", " [fixed in 2.42-17]", " - debian/patches/CVE-2026-5928.patch", " [fixed in 2.42-17]", " - debian/patches/CVE-2026-6238-*.patch", " [fixed in 2.43-3]", " * Delta added:", " - filter -flto=auto from dpkg-buildflags to fix build", " - fix tst-spawn-chdir with coreutils-rs due to invalid link name", " - xfail tst-nscd-basic tstptrguard-static-dlopen (LP #2164576)", " - d/tests: fix gcc dependency cross conflict on i386 autopkgtest", "" ], "package": "glibc", "version": "2.44-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163528 ], "author": "Simon Poirier ", "date": "Tue, 11 Aug 2026 18:48:32 -0400" }, { "cves": [], "log": [ "", " [ Aurelien Jarno ]", " * New upstream release:", " - debian/patches/localedata/sort-UTF8-first.diff: rebased.", " - debian/patches/hurd-i386/local-enable-ldconfig.diff: rebased.", " - debian/patches/hurd-i386/tg-libc_rwlock_recursive.diff: dropped,", " obsolete.", " - debian/patches/hurd-i386/git-fork-gdb.diff: upstreamed.", " - debian/patches/hurd-i386/git-sig-sig-mmx-fix.diff: upstreamed.", " - debian/patches/hurd-i386/git-cancel-sig.diff: upstreamed.", " - debian/patches/hurd-i386/git-mach_send_eintr.diff: upstreamed.", " - debian/patches/hurd-i386/git-itimer-lock.diff: upstreamed.", " - debian/patches/hurd-i386/git-posix-timers.diff: upstreamed.", " - debian/patches/hurd-i386/git-sig-alarm.diff: upstreamed.", " - debian/patches/hurd-i386/git-libio-mtsafe.diff: upstreamed.", " - debian/patches/hurd-i386/git-timedrwlock-unlock.diff: upstreamed.", " - debian/patches/hurd-i386/git-sigtimedwait-timeout.diff: upstreamed.", " - debian/patches/hurd-i386/git-MSG_EXAMINE.diff: upstreamed.", " - debian/patches/hurd-i386/git-interrupt-EINTR.diff: upstreamed.", " - debian/patches/hurd-i386/git-SEM_FAILED.diff: upstreamed.", " - debian/patches/hurd-i386/git-tst-fix.diff: upstreamed.", " - debian/patches/hurd-i386/git-SO_TIMESTAMP.diff: upstreamed.", " - debian/patches/hurd-i386/git-path_mounted.diff: upstreamed.", " - debian/patches/any/local-nss-overflow.diff: upstreamed.", " - debian/patches/any/local-ldconfig-multiarch.diff: refreshed.", " - debian/symbols.wildcards: add 2.44.", " - debian/sysdeps/arm64.mk: stop passing --enable-memory-tagging to", " configure, support for it was removed upstream.", " * debian/patches/git-updates.diff: update from upstream stable branch.", "", " [ Samuel Thibault ]", " * debian/patches/hurd-i386/submitted-net.diff: rebased.", "" ], "package": "glibc", "version": "2.44-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Mon, 10 Aug 2026 15:02:03 +0200" }, { "cves": [ { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" } ], "log": [ "", " [ Samuel Thibault ]", " * debian/testsuite-xfail-debian.mk: Update hurd results.", " * debian/patches/hurd-i386/submitted-path_mounted.diff: Renamed to", " git-path_mounted.diff.", "", " [ Aurelien Jarno ]", " * debian/patches/git-updates.diff: update from upstream stable branch:", " - debian/patches/hurd-i386/local-disable-ioctls.diff: rebased.", " - debian/patches/hurd-i386/submitted-AF_LINK.diff: upstreamed.", " - debian/patches/hurd-i386/submitted-AF_ROUTE.diff: upstreamed.", " - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field", " (CVE-2026-6238). Closes: #1135231.", " - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records", " (CVE-2026-5435). Closes: #1135230.", " - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).", " - Cache cpuid results in ld.so for Intel CPUs.", " - Restore optimized memchr for POWER10.", " * debian/control.in/libc, debian/rules.d/debhelper.mk: drop the libc6-dev", " dependency on rpcsvc-proto.", " * debian/watch: set Git-Mode to shallow.", "" ], "package": "glibc", "version": "2.43-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Mon, 10 Aug 2026 14:19:03 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libc6-dev", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.44-1ubuntu1", "version": "2.44-1ubuntu1" }, "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" } ], "launchpad_bugs_fixed": [ 2163528 ], "changes": [ { "cves": [ { "cve": "CVE-2026-4046", "url": "https://ubuntu.com/security/CVE-2026-4046", "cve_description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.", "cve_priority": "medium", "cve_public_date": "2026-03-30 18:16:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-5450", "url": "https://ubuntu.com/security/CVE-2026-5450", "cve_description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-5928", "url": "https://ubuntu.com/security/CVE-2026-5928", "cve_description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash. A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "cve_priority": "medium", "cve_public_date": "2026-04-20 21:16:00 UTC" }, { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" } ], "log": [ "", " * Merge from Debian experimental (LP: #2163528)", " Delta dropped:", " - Revert \"debian/rules.d/build.mk: add a makefile function to filter out", " dpkg build flags incompatible with glibc and define CFLAGS from dpkg", " build flags. Closes: #1129746.\"", " - fix ftbfs: backport OPEN_TREE conditional define (LP #2145679)", " [fixed upstream in 2.44]", " - debian/patches/CVE-2026-4046.patch", " [fixed in 2.43-3]", " - debian/patches/CVE-2026-5435.patch", " [fixed in 2.43-3]", " - debian/patches/CVE-2026-5450.patch", " [fixed in 2.42-17]", " - debian/patches/CVE-2026-5928.patch", " [fixed in 2.42-17]", " - debian/patches/CVE-2026-6238-*.patch", " [fixed in 2.43-3]", " * Delta added:", " - filter -flto=auto from dpkg-buildflags to fix build", " - fix tst-spawn-chdir with coreutils-rs due to invalid link name", " - xfail tst-nscd-basic tstptrguard-static-dlopen (LP #2164576)", " - d/tests: fix gcc dependency cross conflict on i386 autopkgtest", "" ], "package": "glibc", "version": "2.44-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2163528 ], "author": "Simon Poirier ", "date": "Tue, 11 Aug 2026 18:48:32 -0400" }, { "cves": [], "log": [ "", " [ Aurelien Jarno ]", " * New upstream release:", " - debian/patches/localedata/sort-UTF8-first.diff: rebased.", " - debian/patches/hurd-i386/local-enable-ldconfig.diff: rebased.", " - debian/patches/hurd-i386/tg-libc_rwlock_recursive.diff: dropped,", " obsolete.", " - debian/patches/hurd-i386/git-fork-gdb.diff: upstreamed.", " - debian/patches/hurd-i386/git-sig-sig-mmx-fix.diff: upstreamed.", " - debian/patches/hurd-i386/git-cancel-sig.diff: upstreamed.", " - debian/patches/hurd-i386/git-mach_send_eintr.diff: upstreamed.", " - debian/patches/hurd-i386/git-itimer-lock.diff: upstreamed.", " - debian/patches/hurd-i386/git-posix-timers.diff: upstreamed.", " - debian/patches/hurd-i386/git-sig-alarm.diff: upstreamed.", " - debian/patches/hurd-i386/git-libio-mtsafe.diff: upstreamed.", " - debian/patches/hurd-i386/git-timedrwlock-unlock.diff: upstreamed.", " - debian/patches/hurd-i386/git-sigtimedwait-timeout.diff: upstreamed.", " - debian/patches/hurd-i386/git-MSG_EXAMINE.diff: upstreamed.", " - debian/patches/hurd-i386/git-interrupt-EINTR.diff: upstreamed.", " - debian/patches/hurd-i386/git-SEM_FAILED.diff: upstreamed.", " - debian/patches/hurd-i386/git-tst-fix.diff: upstreamed.", " - debian/patches/hurd-i386/git-SO_TIMESTAMP.diff: upstreamed.", " - debian/patches/hurd-i386/git-path_mounted.diff: upstreamed.", " - debian/patches/any/local-nss-overflow.diff: upstreamed.", " - debian/patches/any/local-ldconfig-multiarch.diff: refreshed.", " - debian/symbols.wildcards: add 2.44.", " - debian/sysdeps/arm64.mk: stop passing --enable-memory-tagging to", " configure, support for it was removed upstream.", " * debian/patches/git-updates.diff: update from upstream stable branch.", "", " [ Samuel Thibault ]", " * debian/patches/hurd-i386/submitted-net.diff: rebased.", "" ], "package": "glibc", "version": "2.44-1", "urgency": "medium", "distributions": "experimental", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Mon, 10 Aug 2026 15:02:03 +0200" }, { "cves": [ { "cve": "CVE-2026-6238", "url": "https://ubuntu.com/security/CVE-2026-6238", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "cve_priority": "medium", "cve_public_date": "2026-04-28 19:37:00 UTC" }, { "cve": "CVE-2026-5435", "url": "https://ubuntu.com/security/CVE-2026-5435", "cve_description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "cve_priority": "medium", "cve_public_date": "2026-04-28 13:19:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" } ], "log": [ "", " [ Samuel Thibault ]", " * debian/testsuite-xfail-debian.mk: Update hurd results.", " * debian/patches/hurd-i386/submitted-path_mounted.diff: Renamed to", " git-path_mounted.diff.", "", " [ Aurelien Jarno ]", " * debian/patches/git-updates.diff: update from upstream stable branch:", " - debian/patches/hurd-i386/local-disable-ioctls.diff: rebased.", " - debian/patches/hurd-i386/submitted-AF_LINK.diff: upstreamed.", " - debian/patches/hurd-i386/submitted-AF_ROUTE.diff: upstreamed.", " - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field", " (CVE-2026-6238). Closes: #1135231.", " - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records", " (CVE-2026-5435). Closes: #1135230.", " - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).", " - Cache cpuid results in ld.so for Intel CPUs.", " - Restore optimized memchr for POWER10.", " * debian/control.in/libc, debian/rules.d/debhelper.mk: drop the libc6-dev", " dependency on rpcsvc-proto.", " * debian/watch: set Git-Mode to shallow.", "" ], "package": "glibc", "version": "2.43-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Aurelien Jarno ", "date": "Mon, 10 Aug 2026 14:19:03 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libclang-cpp22", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "llvm-toolchain-22", "source_package_version": "1:22.1.8-1ubuntu1", "version": "1:22.1.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Apply patch to build for RV23 baseline on riscv64.", " - Don't apply the lldb/test-disable-lldb-i386 patch.", " - Regenerate the control files.", " - Add python3-yaml build dependency.", " - Always require python3-myst-parser.", " - Disable Z3 on stonking for main inclusion (LP: #2166074).", " - Remove OCaml from stonking entirely (LP: #2166916).", " - d/p/fix-vplan-phi-recipe-ordering.patch: fix a RISC-V segfault", " (LP: #2164944).", " * New Changes:", " - Remove stale debian/changelog.dch backup.", " - Update the libc++1, libc++abi1 and libomp5 symbols files: record", " the symbols exported since 22.1.6 with their actual first-seen", " version, and replace the SymbolsHelper subst patterns (which", " dpkg-gensymbols cannot match) with per-architecture entries.", " Unrecorded symbols were stamped with each build's version, which", " made every reverse-dependency require the latest upload.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "author": "Karl Smeltzer ", "date": "Tue, 15 Sep 2026 10:57:20 -0700" }, { "cves": [], "log": [ "", " * New upstream release", " * lldb: ship a system-wide /etc/lldb/lldbinit, configuring the distro", " debuginfod server on Debian and Ubuntu.", " Thanks to Norbert Lange for the patch", " * d/rules: set SCCACHE_BASEDIR to keep sccache cache hits across the", " changing build directory paths", " * d/rules: Also drop the Windows compiler-rt builtins from", " libclang-rt-X.Y-dev (they belong to libclang-rt-X.Y-dev-win). The", " greedy lib/*/*clang_rt* glob shipped them in both packages, causing a", " dpkg \"trying to overwrite\" conflict that broke the autopkgtest install", " on bookworm. Removed the ineffective rm -f in override_dh_auto_install", " in favour of the rm -fr after dh_install, next to the wasi cleanup.", " * d/rules: Fix a make parse error (\"recipe commences before first", " target\") on distributions shipping sccache < 0.14 (e.g. focal): the", " sccache SCCACHE_BASEDIR version-guard block was tab-indented, so the", " $(warning) line was treated as a recipe. Indent the block with spaces.", "", " [ Samuel Thibault ]", " * d/rules: Disable orc instead of disabling compiler-rt on hurd-amd64.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Thu, 18 Jun 2026 17:26:30 +0200" }, { "cves": [], "log": [ "", " * New upstream release", " * enable PRIF (coarray) support", " thanks to Alastair McKinstry", " (Closes: #1136346)", " * Fix the compiler-rt builtins for WASI preview targets (Closes: #1138702)", " Thanks to Max Gilmour for the patch", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.7-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Tue, 02 Jun 2026 09:17:45 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libclang1-22", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "llvm-toolchain-22", "source_package_version": "1:22.1.8-1ubuntu1", "version": "1:22.1.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Apply patch to build for RV23 baseline on riscv64.", " - Don't apply the lldb/test-disable-lldb-i386 patch.", " - Regenerate the control files.", " - Add python3-yaml build dependency.", " - Always require python3-myst-parser.", " - Disable Z3 on stonking for main inclusion (LP: #2166074).", " - Remove OCaml from stonking entirely (LP: #2166916).", " - d/p/fix-vplan-phi-recipe-ordering.patch: fix a RISC-V segfault", " (LP: #2164944).", " * New Changes:", " - Remove stale debian/changelog.dch backup.", " - Update the libc++1, libc++abi1 and libomp5 symbols files: record", " the symbols exported since 22.1.6 with their actual first-seen", " version, and replace the SymbolsHelper subst patterns (which", " dpkg-gensymbols cannot match) with per-architecture entries.", " Unrecorded symbols were stamped with each build's version, which", " made every reverse-dependency require the latest upload.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "author": "Karl Smeltzer ", "date": "Tue, 15 Sep 2026 10:57:20 -0700" }, { "cves": [], "log": [ "", " * New upstream release", " * lldb: ship a system-wide /etc/lldb/lldbinit, configuring the distro", " debuginfod server on Debian and Ubuntu.", " Thanks to Norbert Lange for the patch", " * d/rules: set SCCACHE_BASEDIR to keep sccache cache hits across the", " changing build directory paths", " * d/rules: Also drop the Windows compiler-rt builtins from", " libclang-rt-X.Y-dev (they belong to libclang-rt-X.Y-dev-win). The", " greedy lib/*/*clang_rt* glob shipped them in both packages, causing a", " dpkg \"trying to overwrite\" conflict that broke the autopkgtest install", " on bookworm. Removed the ineffective rm -f in override_dh_auto_install", " in favour of the rm -fr after dh_install, next to the wasi cleanup.", " * d/rules: Fix a make parse error (\"recipe commences before first", " target\") on distributions shipping sccache < 0.14 (e.g. focal): the", " sccache SCCACHE_BASEDIR version-guard block was tab-indented, so the", " $(warning) line was treated as a recipe. Indent the block with spaces.", "", " [ Samuel Thibault ]", " * d/rules: Disable orc instead of disabling compiler-rt on hurd-amd64.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Thu, 18 Jun 2026 17:26:30 +0200" }, { "cves": [], "log": [ "", " * New upstream release", " * enable PRIF (coarray) support", " thanks to Alastair McKinstry", " (Closes: #1136346)", " * Fix the compiler-rt builtins for WASI preview targets (Closes: #1138702)", " Thanks to Max Gilmour for the patch", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.7-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Tue, 02 Jun 2026 09:17:45 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libllvm22", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "llvm-toolchain-22", "source_package_version": "1:22.1.8-1ubuntu1", "version": "1:22.1.8-1ubuntu1" }, "cves": [], "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "changes": [ { "cves": [], "log": [ "", " * Merge with Debian unstable. Remaining changes:", " - Apply patch to build for RV23 baseline on riscv64.", " - Don't apply the lldb/test-disable-lldb-i386 patch.", " - Regenerate the control files.", " - Add python3-yaml build dependency.", " - Always require python3-myst-parser.", " - Disable Z3 on stonking for main inclusion (LP: #2166074).", " - Remove OCaml from stonking entirely (LP: #2166916).", " - d/p/fix-vplan-phi-recipe-ordering.patch: fix a RISC-V segfault", " (LP: #2164944).", " * New Changes:", " - Remove stale debian/changelog.dch backup.", " - Update the libc++1, libc++abi1 and libomp5 symbols files: record", " the symbols exported since 22.1.6 with their actual first-seen", " version, and replace the SymbolsHelper subst patterns (which", " dpkg-gensymbols cannot match) with per-architecture entries.", " Unrecorded symbols were stamped with each build's version, which", " made every reverse-dependency require the latest upload.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166074, 2166916, 2164944 ], "author": "Karl Smeltzer ", "date": "Tue, 15 Sep 2026 10:57:20 -0700" }, { "cves": [], "log": [ "", " * New upstream release", " * lldb: ship a system-wide /etc/lldb/lldbinit, configuring the distro", " debuginfod server on Debian and Ubuntu.", " Thanks to Norbert Lange for the patch", " * d/rules: set SCCACHE_BASEDIR to keep sccache cache hits across the", " changing build directory paths", " * d/rules: Also drop the Windows compiler-rt builtins from", " libclang-rt-X.Y-dev (they belong to libclang-rt-X.Y-dev-win). The", " greedy lib/*/*clang_rt* glob shipped them in both packages, causing a", " dpkg \"trying to overwrite\" conflict that broke the autopkgtest install", " on bookworm. Removed the ineffective rm -f in override_dh_auto_install", " in favour of the rm -fr after dh_install, next to the wasi cleanup.", " * d/rules: Fix a make parse error (\"recipe commences before first", " target\") on distributions shipping sccache < 0.14 (e.g. focal): the", " sccache SCCACHE_BASEDIR version-guard block was tab-indented, so the", " $(warning) line was treated as a recipe. Indent the block with spaces.", "", " [ Samuel Thibault ]", " * d/rules: Disable orc instead of disabling compiler-rt on hurd-amd64.", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.8-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Thu, 18 Jun 2026 17:26:30 +0200" }, { "cves": [], "log": [ "", " * New upstream release", " * enable PRIF (coarray) support", " thanks to Alastair McKinstry", " (Closes: #1136346)", " * Fix the compiler-rt builtins for WASI preview targets (Closes: #1138702)", " Thanks to Max Gilmour for the patch", "" ], "package": "llvm-toolchain-22", "version": "1:22.1.7-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Sylvestre Ledru ", "date": "Tue, 02 Jun 2026 09:17:45 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "libupki-openssl1", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "upki", "source_package_version": "1.0.0~beta.3+repack-0ubuntu2", "version": "1.0.0~beta.3+repack-0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Fix overflow on 32-bit architecture", "" ], "package": "upki", "version": "1.0.0~beta.3+repack-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 16:36:34 +0200" }, { "cves": [], "log": [ "", " [ Rui Marques ]", " * Fix the upki autopkgtest configuration path", "", " [ Julian Andres Klode ]", " * openssl: Do not fail on empty store", " * d/rules: Check that we do not call setuid() and friends", " * Recommend upki from the libraries", " * Only fetch new revocations every 6 hours", " * upki fetch: Refuse to run as root", " * rust-vendor: revendor", "", " [ Zara Grigoryan ]", " * d/upki: Ship AppArmor profile usr.bin.upki", " * debian: enable unit tests and preserve cbindgen fixtures", "" ], "package": "upki", "version": "1.0.0~beta.3+repack-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 15:22:26 +0200" }, { "cves": [], "log": [ "", " * New upstream release", " * Refresh copyright for added, removed, changed crates", " * Fix cmakelist.txt copyright issue for jitterentropy", " * d/rules: Build using fetch-native-tls (OpenSSL)", "" ], "package": "upki", "version": "1.0.0~beta.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 18 Aug 2026 22:43:26 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-8", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-headers-7.3.0-8 version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-headers-7.3.0-8 version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-headers-7.3.0-8-generic version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-headers-7.3.0-8-generic version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-image-7.3.0-8-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 1786013, 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:08:49 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:13:46 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-signed", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:13 +0200" } ], "notes": "linux-image-7.3.0-8-generic version '7.3.0-8.8' (source package linux-signed version '7.3.0-8.8') was added. linux-image-7.3.0-8-generic version '7.3.0-8.8' has the same source package name, linux-signed, as removed package linux-image-7.3.0-5-generic. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-libc-dev", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-libc-dev version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-libc-dev version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-8-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-8.8+1", "version": "7.3.0-8.8+1" }, "cves": [], "launchpad_bugs_fixed": [ 1786013, 1786013, 1786013, 2166733, 1786013 ], "changes": [ { "cves": [], "log": [ "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.09.28)", "", " * Miscellaneous Ubuntu changes", " - [Packaging] lmm: Process all modules and fail only at the end if any failed", " - [Packaging] Add various dependencies for Lustre", " - [Packaging] Fix dkms.conf PACKAGE_VERSION parsing across newlines", " - [Packaging]: Add an rdepends option for dependent modules", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.3.0-8.8+1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Wed, 30 Sep 2026 15:06:15 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-8.8", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", "" ], "package": "linux-main-signed", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:09:11 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-7.7", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.09.28)", "" ], "package": "linux-main-signed", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 18:14:13 +0200" }, { "cves": [], "log": [ "", "", " * New upstream core24.60 release (LP: #2166733)", " - [Packaging] add bison/flex for iwlwifi", "", " * Miscellaneous Ubuntu changes", " - [Packaging]: lmm: Add the kernel version to the kernel variant", " - [Packaging] lmm: Add flavour migration support", " - [Packaging] Allow debpaths of additional formats", " - [Packaging] Remove compat file from lmg ancillary", " - [Packaging]: Update manifest file with new patches", "" ], "package": "linux-main-signed", "version": "7.3.0-6.6+1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166733 ], "author": "Paolo Pisati ", "date": "Tue, 22 Sep 2026 09:33:03 +0200" }, { "cves": [], "log": [ "", " * Main version: 7.3.0-6.6", "", " * Packaging resync (LP: #1786013)", " - [Packaging] debian/tracking-bug -- resync from main package", " - [Packaging] debian/dkms-versions -- update from kernel-versions", " (main/d2026.09.21)", "" ], "package": "linux-main-signed", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 1786013 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 17:08:41 +0200" } ], "notes": "linux-main-modules-zfs-7.3.0-8-generic version '7.3.0-8.8+1' (source package linux-main-signed version '7.3.0-8.8+1') was added. linux-main-modules-zfs-7.3.0-8-generic version '7.3.0-8.8+1' has the same source package name, linux-main-signed, as removed package linux-main-modules-zfs-7.3.0-5-generic. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-modules-7.3.0-8-generic version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-modules-7.3.0-8-generic version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-8", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-tools-7.3.0-8 version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-tools-7.3.0-8 version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-8-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": null }, "to_version": { "source_package_name": "linux", "source_package_version": "7.3.0-8.8", "version": "7.3.0-8.8" }, "cves": [], "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501, 2168730, 2168432, 2160082, 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "changes": [ { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-8.8 -proposed tracker (LP: #2168832)", "", " * Ubuntu 26.04 linux kernel has non-functional nova-core GPU driver enabled,", " conflicting with nouveau (LP: #2150845)", " - [Config] Disable DRM_NOVA", " - [Config] Disable NOVA_CORE", "", " * Include v4l2loopback in default modules set for 26.04 (LP: #2168012)", " - [Packaging] Add dependency for v4l2loopback", "", " * linux: enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE (LP: #2158501)", " - [Config] Enable CONFIG_EROFS_FS_PAGE_CACHE_SHARE", "" ], "package": "linux", "version": "7.3.0-8.8", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168832, 2150845, 2168012, 2158501 ], "author": "Paolo Pisati ", "date": "Tue, 29 Sep 2026 19:04:39 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-7.7 -proposed tracker (LP: #2168730)", "", " * Stonking real-time patchset v7.3-rc4-rt1 (LP: #2168432)", " - SAUCE: drm/i915: Use preempt_disable/enable_rt() where recommended", " - SAUCE: drm/i915: Don't disable interrupts on PREEMPT_RT during atomic", " updates", " - SAUCE: drm/i915: Disable tracing points on PREEMPT_RT", " - SAUCE: drm/i915/gt: Use spin_lock_irq() instead of local_irq_disable() +", " spin_lock()", " - SAUCE: drm/i915: Drop the irqs_disabled() check", " - SAUCE: drm/i915/guc: Consider also RCU depth in busy loop.", " - SAUCE: Revert \"drm/i915: Depend on !PREEMPT_RT.\"", " - SAUCE: drm/i915: Consider RCU read section as atomic.", " - [debian] update master upstream-realtime", "", " * Linux, Ubuntu, 24.04, System hangs for about 10 seconds when unplug", " external monitor cable on non TBT dock (LP: #2160082)", " - Revert \"UBUNTU: SAUCE: drm/i915/lnl+/tc: Fix false disconnect of active", " DP-alt TC port during long HPD pulse\"", "" ], "package": "linux", "version": "7.3.0-7.7", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2168730, 2168432, 2160082 ], "author": "Paolo Pisati ", "date": "Mon, 28 Sep 2026 17:46:02 +0200" }, { "cves": [], "log": [ "", " * stonking/linux: 7.3.0-6.6 -proposed tracker (LP: #2167819)", "", " * 26.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2167217)", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe the", " PCIe M.2 Key M connector", " - SAUCE: arm64: dts: qcom: x1e78100-lenovo-thinkpad-t14s: Describe PCIe", " M.2 1620 LGA connector", " - SAUCE: arm64: dts: qcom: hamoa/purwa: Add QREF regulator supplies", " - SAUCE: dt-bindings: arm: qcom: Distinguish IdeaCentre Mini 01Q8X10 SKUs", " - SAUCE: arm64: dts: qcom: Split IdeaCentre Mini into a common DTSI", " - SAUCE: arm64: dts: qcom: Add Purwa IdeaCentre Mini 01Q8X10", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Build the Hamoa EL2 DTB", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Fix the second M.2 3V3 rail", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Wire up DP sound names and VA", " macro", " - SAUCE: arm64: dts: qcom: ideacentre-mini: Drop the unused USB MP port", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Ideapad Slim 5 variants", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaPad 5 models", " - SAUCE: arm64: dts: qcom: Add Lenovo IdeaPad Slim 5x 14Q8X9", " - SAUCE: arm64: dts: qcom: glymur: Add PCIe3 PHY and PCIe3a controller", " nodes", " - SAUCE: arm64: dts: qcom: glymur-crd: Add PHY supplies for pcie3_phy", " - SAUCE: dt-bindings: arm: qcom: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: arm64: dts: qcom: glymur: Add Asus Zenbook A14 (UX3407NA)", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)", " - SAUCE: dt-bindings: arm: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: arm64: dts: qcom: Add HP EliteBook X G2q 14 AI", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AI", " - SAUCE: dt-bindings: arm: qcom: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: arm64: dts: qcom: glymur: Add Lenovo Yoga Slim 7x Gen11", " - SAUCE: firmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11", " - SAUCE: phy: qcom: edp: split power-on sequencing by PHY version", " - SAUCE: phy: qcom: edp: update v8 power-on programming sequence", "", " * Support TI TAC5xx2 audio codec on Intel NVL platform (LP: #2167689)", " - soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list", "", " * Add support for Zen6 EPP tunings (LP: #2167558)", " - cpufreq/amd-pstate: Add per SoC and per core type EPP tuning values", " - cpufreq/amd-pstate: Add EPP tunings for Zen6 client platforms", " - cpufreq/amd-pstate: Show a warning if missing EPP tunings", "", " * Zen 6 client HSMP support (LP: #2167555)", " - SAUCE: platform/x86/amd/hsmp: Add HSMP client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Route metric table through the client", " messages", " - SAUCE: platform/x86/amd/hsmp: Add ACPI client support for Family 1Ah", " - SAUCE: platform/x86/amd/hsmp: Document and expose client telemetry table", " in UAPI", "", " * Fix fTPM handling on Zen 6 platforms (LP: #2167552)", " - tpm: Call cmd_ready/go_idle for each command transmission", "", " * Add support for CPPC values for Zen6 (LP: #2167550)", " - SAUCE: ACPI: CPPC: Refactor boost ratio handling", " - SAUCE: cpufreq/acpi-cpufreq: Use amd_get_boost_ratio()", " - SAUCE: cpufreq/amd-pstate: Get Highest Freq for a CPU", "", " * Support Samsung S5K3J1 sensor for Intel MIPI camera (LP: #2121852)", " - SAUCE: media: ipu-bridge: Support s5k3j1 sensor", "", " * 25.10 Snapdragon X Elite: Sync concept kernel changes (LP: #2121477)", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Add Left/Right", " Speakers and Tweeter", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable MICs LDO", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: Mark audio channels", " as left-right swapped", " - SAUCE: arm64: dts: qcom: x1-acer-swift-14: Add support for Acer Swift 14", " - SAUCE: dt-bindings: arm: qcom: Add Acer Swift 14 AI", " - SAUCE: Update x1-acer device trees for v7.3", "", " * 26.04 Snapdragon X Elite: Sync concept kernel changes (LP: #2144643)", " - SAUCE: dt-bindings: phy: qcom: Add CSI2 C-PHY/DPHY schema", " - SAUCE: phy: qcom-mipi-csi2: Add a CSI2 MIPI DPHY driver", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add simple-mfd", " compatible", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add optional PHY handle", " definitions", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Add support for combo-", " mode endpoints", " - SAUCE: dt-bindings: media: qcom,x1e80100-camss: Describe iommu entries", " - SAUCE: media: qcom: camss: Add legacy_phy flag to SoC definition", " structures", " - SAUCE: media: qcom: camss: Add support for PHY API devices", " - SAUCE: media: qcom: camss: Drop legacy PHY descriptions from x1e", " - SAUCE: arm64: dts: qcom: x1e80100: Add CCI definitions", " - SAUCE: arm64: dts: qcom: x1e80100: Add CAMSS block definition", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add pm8010 CRD pmic,id=m", " regulators", " - SAUCE: arm64: dts: qcom: x1e80100-crd: Add ov08x40 RGB sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add pm8010 camera PMIC with", " voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-t14s: Add on ov02c10 RGB sensor on", " CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add pm8010 camera", " PMIC with voltage levels for IR and RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add l7b_2p8", " voltage regulator for RGB camera", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Add ov02c10 RGB", " sensor on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-inspiron14-7441: Switch on CAMSS", " RGB sensor", " - SAUCE: arm64: dts: qcom: x1e78100-t14s: enable camera privacy indicator", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: enable camera", " privacy indicator", " - SAUCE: arm64: dts: qcom: x1-asus-zenbook-a14: Add on OV02C10 RGB sensor", " on CSIPHY4", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: add camera support", " - SAUCE: arm64: dts: qcom: x1e80100-dell-xps13-9345: enable camera privacy", " indicator", " - SAUCE: arm64: dts: qcom: x1e-acer-swift-14: Move PCIe PERST and Wake", " GPIOs to port nodes", "", " * Add support for AMD Zen6 client SFH (LP: #2167219)", " - SAUCE: HID: amd_sfh: Add DMI quirk and module param to disable", " interrupts", " - SAUCE: HID: amd_sfh: Add support for newer AMD SoCs", " - SAUCE: HID: amd_sfh: Add HPD support for new AMD SOC", " - SAUCE: HID: amd_sfh: Add device mode support for latest AMD SOC.", "", " * append bpf to CONFIG_LSM (LP: #2166235)", " - [Config] append bpf to CONFIG_LSM", "", " * Malformed HV_LINUX_VENDOR_ID breaks VM Availability Metric on Azure", " (LP: #2158462)", " - SAUCE: (no-up) hv: Fix supplied vendor ID", "", " * Miscellaneous Ubuntu changes", " - [Packaging] Add incremental rebuild support", " - [Packaging] Snapshot incremental rebuild packages", " - SAUCE: arm64: dts: qcom: x1p42100-hp-elitebook-6-g1q: DT for HP", " EliteBook 6 G1q", " - SAUCE: arm64: dts: qcom: x1e80100-lenovo-yoga-slim7x: Fix RGB camera", " supplies", " - SAUCE: dt-bindings: arm: qcom: Document HP EliteBook 6 G1q", " - SAUCE: firmware: qcom: scm: Allow QSEECOM for HP EliteBook 6 G1q", " - [packaging] Create a linux-main-modules dependency toggle", " - [Config] toolchain version update", " - [Config] updateconfigs after v7.3-rc4 rebase", " - [Config] enable new v7.3-rc4 drivers as modules", " - [Packaging] Build-depend on clang/LLVM 22 to match rustc", " - [Packaging] compress the SPDX SBOM documents in linux-buildinfo", "" ], "package": "linux", "version": "7.3.0-6.6", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2167819, 2167217, 2167689, 2167558, 2167555, 2167552, 2167550, 2121852, 2121477, 2144643, 2167219, 2166235, 2158462 ], "author": "Paolo Pisati ", "date": "Mon, 21 Sep 2026 16:57:39 +0200" } ], "notes": "linux-tools-7.3.0-8-generic version '7.3.0-8.8' (source package linux version '7.3.0-8.8') was added. linux-tools-7.3.0-8-generic version '7.3.0-8.8' has the same source package name, linux, as removed package linux-headers-7.3.0-5. As such we can use the source package version of the removed package, '7.3.0-5.5', as the starting point in our changelog diff. Kernel packages are an example of where the binary package name changes for the same source package. Using the removed package source package version as our starting point means we can still get meaningful changelog diffs even for what appears to be a new package.", "is_version_downgrade": false }, { "name": "manpages-dev", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "manpages", "source_package_version": "6.19-3", "version": "6.19-3" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Fix typo in pathname to actually close #1146566", "" ], "package": "manpages", "version": "6.19-3", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Dr. Tobias Quathamer ", "date": "Fri, 04 Sep 2026 14:58:16 +0200" }, { "cves": [], "log": [ "", " * Add output to autopkgtests for easier debugging", " * Use man3/tolower_l.3 to check for installed symlinks.", " The previously used symlink man3/tcflow.3 has been turned", " into a proper manpage, so the autopkgtest check that", " it is a symlink failed. (Closes: #1146566)", "" ], "package": "manpages", "version": "6.19-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Dr. Tobias Quathamer ", "date": "Thu, 03 Sep 2026 11:47:07 +0200" }, { "cves": [], "log": [ "", " * New upstream version 6.19", " - Refresh patches", " * Update d/copyright", " * Do not install manpages for man0 and man9", "" ], "package": "manpages", "version": "6.19-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Dr. Tobias Quathamer ", "date": "Wed, 26 Aug 2026 17:57:51 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "python3-bpfcc", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "bpfcc", "source_package_version": "0.35.0+ds-1ubuntu4", "version": "0.35.0+ds-1ubuntu4" }, "cves": [], "launchpad_bugs_fixed": [ 2166528 ], "changes": [ { "cves": [], "log": [ "", " * d/p/git-fix-llvm22.patch: add support for LLVM 22 (LP: #2166528)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu4", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2166528 ], "author": "Karl Smeltzer ", "date": "Fri, 04 Sep 2026 11:14:31 -0700" }, { "cves": [], "log": [ "", " * No-change rebuild for llvm-defaults (now version 22)", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Karl Smeltzer ", "date": "Thu, 03 Sep 2026 16:00:07 -0400" }, { "cves": [], "log": [ "", " * No-change rebuild to build with LLVM 21 on amd64v3.", "" ], "package": "bpfcc", "version": "0.35.0+ds-1ubuntu2", "urgency": "medium", "distributions": "resolute", "launchpad_bugs_fixed": [], "author": "Matthias Klose ", "date": "Mon, 16 Mar 2026 12:30:24 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "python3-netaddr", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "python-netaddr", "source_package_version": "1.3.0-2", "version": "1.3.0-2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Team Upload", " * Drop \"Rules-Requires-Root: no\": it is the default now", " * Rewrite d/watch in v5 format", " * Bump Standards-Version to 4.7.4, drop Priority: tag", " * Set upstream metadata fields: Contact, Documentation, Repository.", " * Add debian/salsa-ci.yml", " * Mark localehelper as ", "" ], "package": "python-netaddr", "version": "1.3.0-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Sat, 04 Jul 2026 10:29:14 +0200" }, { "cves": [], "log": [ "", " * Team Upload", " * Trim autopktest deps, avoid @builddeps@", " * Update lintian-overrides for new syntax", " * New upstream version 1.3.0", " * Build with pybuild-plugin-pyproject", "" ], "package": "python-netaddr", "version": "1.3.0-1", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Fri, 21 Feb 2025 19:59:11 +0100" }, { "cves": [], "log": [ "", " * Team Upload", " * Fix syntax error in Maintainer: field that confuses UDD & the Tracker", " * Use dh-sequence-python3", " * Set \"Rules-Requires-Root: no\"", "" ], "package": "python-netaddr", "version": "0.10.1-2", "urgency": "medium", "distributions": "unstable", "launchpad_bugs_fixed": [], "author": "Alexandre Detiste ", "date": "Mon, 23 Dec 2024 18:02:52 +0100" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "systemd-tpm", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "systemd", "source_package_version": "261.3-0ubuntu3", "version": "261.3-0ubuntu3" }, "cves": [], "launchpad_bugs_fixed": [ 2169316 ], "changes": [ { "cves": [], "log": [ "", " * d/rules: remove libssl3t64 Depends (LP: #2169316)", "" ], "package": "systemd", "version": "261.3-0ubuntu3", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [ 2169316 ], "author": "Nick Rosbrook ", "date": "Fri, 02 Oct 2026 13:35:38 -0400" }, { "cves": [], "log": [ "", " * d/udev.install: do not install tpm2 rules on i386", "" ], "package": "systemd", "version": "261.3-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Wed, 23 Sep 2026 08:39:15 -0400" }, { "cves": [], "log": [ "", " * New upstream stable version 261.3", " - d/gbp.conf: set upstream branch to 261.x stable", " - d/watch: track 261.x stable", " - Update upstream source from tag 'upstream/261.3'", " Update to upstream version '261.3'", " with Debian dir 3857375784a9bdd0b319a0e09222392a5d485461", " - Bug fixes", " * mkosi: remove systemd from minimal-base on ubuntu", " * d/systemd.links: stop creating hwclock.service mask", "" ], "package": "systemd", "version": "261.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Nick Rosbrook ", "date": "Mon, 21 Sep 2026 17:15:49 -0400" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false }, { "name": "upki", "from_version": { "source_package_name": null, "source_package_version": null, "version": null }, "to_version": { "source_package_name": "upki", "source_package_version": "1.0.0~beta.3+repack-0ubuntu2", "version": "1.0.0~beta.3+repack-0ubuntu2" }, "cves": [], "launchpad_bugs_fixed": [], "changes": [ { "cves": [], "log": [ "", " * Fix overflow on 32-bit architecture", "" ], "package": "upki", "version": "1.0.0~beta.3+repack-0ubuntu2", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 16:36:34 +0200" }, { "cves": [], "log": [ "", " [ Rui Marques ]", " * Fix the upki autopkgtest configuration path", "", " [ Julian Andres Klode ]", " * openssl: Do not fail on empty store", " * d/rules: Check that we do not call setuid() and friends", " * Recommend upki from the libraries", " * Only fetch new revocations every 6 hours", " * upki fetch: Refuse to run as root", " * rust-vendor: revendor", "", " [ Zara Grigoryan ]", " * d/upki: Ship AppArmor profile usr.bin.upki", " * debian: enable unit tests and preserve cbindgen fixtures", "" ], "package": "upki", "version": "1.0.0~beta.3+repack-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Fri, 18 Sep 2026 15:22:26 +0200" }, { "cves": [], "log": [ "", " * New upstream release", " * Refresh copyright for added, removed, changed crates", " * Fix cmakelist.txt copyright issue for jitterentropy", " * d/rules: Build using fetch-native-tls (OpenSSL)", "" ], "package": "upki", "version": "1.0.0~beta.3-0ubuntu1", "urgency": "medium", "distributions": "stonking", "launchpad_bugs_fixed": [], "author": "Julian Andres Klode ", "date": "Tue, 18 Aug 2026 22:43:26 +0200" } ], "notes": "For a newly added package only the three most recent changelog entries are shown.", "is_version_downgrade": false } ], "snap": [] }, "removed": { "deb": [ { "name": "linux-headers-7.3.0-5", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-headers-7.3.0-5-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-image-7.3.0-5-generic", "from_version": { "source_package_name": "linux-signed", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-main-modules-zfs-7.3.0-5-generic", "from_version": { "source_package_name": "linux-main-signed", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-modules-7.3.0-5-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-5", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false }, { "name": "linux-tools-7.3.0-5-generic", "from_version": { "source_package_name": "linux", "source_package_version": "7.3.0-5.5", "version": "7.3.0-5.5" }, "to_version": { "source_package_name": null, "source_package_version": null, "version": null }, "cves": [], "launchpad_bugs_fixed": [], "changes": [], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "notes": "Changelog diff for Ubuntu 26.10 stonking image from daily image serial 20260919 to 20261006", "from_series": "stonking", "to_series": "stonking", "from_serial": "20260919", "to_serial": "20261006", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }