Ubuntu Linux (Canonical) - vulnerabilities (CVEs)

4121 CVEs, 0 in the last 30 days, 152 known versions, newest CVE from 2026-05-28. Vendor: Canonical.

CVEs of Ubuntu Linux

CVE-2026-47334 - CVSS 5.5 (medium), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be…
CVE-2026-47337 - CVSS 3.3 (low), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug…
CVE-2026-47333 - CVSS 7.8 (high), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap…
CVE-2026-47336 - CVSS 3.3 (low), 2026-05-28: Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be…
CVE-2026-47335 - CVSS 5.5 (medium), 2026-05-28: Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an…
CVE-2026-47331 - CVSS 7.8 (high), 2026-05-28: Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race…
CVE-2026-47330 - CVSS 3.3 (low), 2026-05-28: Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling…
CVE-2026-47329 - CVSS 3.3 (low), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be…
CVE-2026-47332 - CVSS 5.5 (medium), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read…
CVE-2026-47328 - CVSS 6.1 (medium), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the…
CVE-2026-47327 - CVSS 3.3 (low), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be…
CVE-2026-47326 - CVSS 5.5 (medium), 2026-05-28: Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can be triggered…
CVE-2026-31431 - CVSS 7.8 (high), 2026-04-22: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit…
CVE-2026-3888 - CVSS 7.8 (high), 2026-03-17: Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles…
CVE-2026-3497 - CVSS 8.2 (high), 2026-03-12: Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux…
CVE-2025-13350 - CVSS 7.1 (high), 2026-03-05: Ubuntu Linux 6.8 GA retains the legacy AF_UNIX garbage collector but backports upstream commit 8594d9b85c07 ("af_unix: Don’t call skb_get() for OOB skb").…
CVE-2025-32463 - CVSS 9.3 (critical), 2025-06-30: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2025-5054 - CVSS 4.7 (medium), 2025-05-30: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.…
CVE-2023-5616 - CVSS 4.9 (medium), 2025-04-15: In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for…
CVE-2022-1804 - CVSS 5.5 (medium), 2025-03-25: accountsservice no longer drops permissions when writting .pam_environment
CVE-2025-26466 - CVSS 5.9 (medium), 2025-02-28: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of…
CVE-2022-1736 - CVSS 9.8 (critical), 2025-01-31: Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
CVE-2024-6387 - CVSS 8.1 (high), 2024-07-01: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an…
CVE-2020-27352 - CVSS 9.3 (critical), 2024-06-21: When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move…
CVE-2022-28658 - CVSS 5.5 (medium), 2024-06-04: Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
CVE-2022-28657 - CVSS 7.8 (high), 2024-06-04: Apport does not disable python crash handler before entering chroot
CVE-2022-28656 - CVSS 5.5 (medium), 2024-06-04: is_closing_session() allows users to consume RAM in the Apport process
CVE-2022-28655 - CVSS 7.1 (high), 2024-06-04: is_closing_session() allows users to create arbitrary tcp dbus connections
CVE-2022-28654 - CVSS 5.5 (medium), 2024-06-04: is_closing_session() allows users to fill up apport.log
CVE-2022-28652 - CVSS 5.5 (medium), 2024-06-04: ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
CVE-2022-1242 - CVSS 7.8 (high), 2024-06-03: Apport can be tricked into connecting to arbitrary sockets as the root user
CVE-2021-3899 - CVSS 7.8 (high), 2024-06-03: There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as…
CVE-2021-3600 - CVSS 7.8 (high), 2024-01-08: It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when performing div and mod…
CVE-2023-1032 - CVSS 5.5 (medium), 2024-01-08: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced…
CVE-2022-3328 - CVSS 7.8 (high), 2024-01-08: Race condition in snap-confine's must_mkdir_and_open_with_perms()
CVE-2022-2602 - CVSS 7 (high), 2024-01-08: io_uring UAF, Unix SCM garbage collection
CVE-2022-2586 - CVSS 7.8 (high), 2024-01-08: It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
CVE-2022-2585 - CVSS 7.8 (high), 2024-01-08: It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free.
CVE-2022-2588 - CVSS 7.8 (high), 2024-01-08: It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its…
CVE-2023-5536 - CVSS 6.4 (medium), 2023-12-12: A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege…
CVE-2023-45866 - CVSS 6.3 (medium), 2023-12-08: Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID…
CVE-2023-4911 - CVSS 7.8 (high), 2023-10-03: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow…
CVE-2023-44216 - CVSS 5.3 (medium), 2023-09-27: PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing…
CVE-2023-3777 - CVSS 7.8 (high), 2023-09-06: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When…
CVE-2023-3297 - CVSS 8.1 (high), 2023-09-01: In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the…
CVE-2023-1523 - CVSS 10 (critical), 2023-09-01: Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary…
CVE-2023-40283 - CVSS 7.8 (high), 2023-08-14: An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children…
CVE-2023-32629 - CVSS 7.8 (high), 2023-07-26: Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu…
CVE-2023-2640 - CVSS 7.8 (high), 2023-07-26: On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unprivileged user may…
CVE-2023-3567 - CVSS 7.1 (high), 2023-07-24: A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user…
CVE-2023-31248 - CVSS 7.8 (high), 2023-07-05: Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and…
CVE-2023-3389 - CVSS 7.8 (high), 2023-06-28: A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll…
CVE-2023-35788 - CVSS 7.8 (high), 2023-06-16: An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower…
CVE-2023-2612 - CVSS 4.7 (medium), 2023-05-31: Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some…
CVE-2023-1786 - CVSS 5.5 (medium), 2023-04-26: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly…
CVE-2022-2084 - CVSS 5.5 (medium), 2023-04-19: Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed…
CVE-2023-1326 - CVSS 7.8 (high), 2023-04-13: A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow…
CVE-2020-11935 - CVSS 5.5 (medium), 2023-04-07: It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to…
CVE-2023-0179 - CVSS 7.8 (high), 2023-03-27: A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses,…
CVE-2023-1380 - CVSS 7.1 (high), 2023-03-27: A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This…
CVE-2023-0386 - CVSS 7.8 (high), 2023-03-22: A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s…
CVE-2022-40617 - CVSS 7.5 (high), 2022-10-31: strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA)…
CVE-2022-41222 - CVSS 7 (high), 2022-09-21: mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
CVE-2022-39177 - CVSS 8.8 (high), 2022-09-02: BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in…
CVE-2022-39176 - CVSS 8.8 (high), 2022-09-02: BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because profiles/audio/avrcp.c does not validate params_len.
CVE-2022-1184 - CVSS 5.5 (medium), 2022-08-29: A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a…
CVE-2021-3975 - CVSS 6.5 (medium), 2022-08-23: A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being…
CVE-2021-3905 - CVSS 7.5 (high), 2022-08-23: A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available…
CVE-2022-34918 - CVSS 7.8 (high), 2022-07-04: An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local…
CVE-2022-29581 - CVSS 7.8 (high), 2022-05-17: Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects:…
CVE-2022-1055 - CVSS 8.6 (high), 2022-03-29: A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires…
CVE-2021-3748 - CVSS 7.5 (high), 2022-03-23: A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access…
CVE-2021-3737 - CVSS 7.5 (high), 2022-03-04: A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server,…
CVE-2021-3640 - CVSS 7 (high), 2022-03-03: A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way…
CVE-2022-0492 - CVSS 7.8 (high), 2022-03-03: A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
CVE-2021-4115 - CVSS 5.5 (medium), 2022-02-21: There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process file descriptor exhaustion. The highest threat from…
CVE-2021-44142 - CVSS 8.8 (high), 2022-02-21: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a…
CVE-2021-4093 - CVSS 8.8 (high), 2022-02-18: A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger…
CVE-2016-2124 - CVSS 5.9 (medium), 2022-02-18: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even…
CVE-2020-25722 - CVSS 8.8 (high), 2022-02-18: Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total…
CVE-2020-25719 - CVSS 7.2 (high), 2022-02-18: A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become…
CVE-2020-25717 - CVSS 8.1 (high), 2022-02-18: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
CVE-2021-3155 - CVSS 5.5 (medium), 2022-02-17: snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to…
CVE-2021-4120 - CVSS 8.2 (high), 2022-02-17: snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary…
CVE-2021-44731 - CVSS 7.8 (high), 2022-02-17: A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to…
CVE-2021-44730 - CVSS 8.8 (high), 2022-02-17: snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause…
CVE-2021-3560 - CVSS 7.8 (high), 2022-02-16: It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.…
CVE-2021-45079 - CVSS 9.1 (critical), 2022-01-31: In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2021-45417 - CVSS 7.8 (high), 2022-01-20: AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a…
CVE-2022-20698 - CVSS 7.5 (high), 2022-01-14: A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an…
CVE-2021-44420 - CVSS 7.3 (high), 2021-12-08: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control…
CVE-2021-3939 - CVSS 7.8 (high), 2021-11-17: Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to…
CVE-2021-32554 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport…
CVE-2021-32553 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package…
CVE-2021-32552 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package…
CVE-2021-32555 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package…
CVE-2021-32551 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package…
CVE-2021-32550 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package…
CVE-2021-32549 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package…