CVE-2026-68155

A flaw was found in the libceph component of the Linux kernel. A remote attacker could send a specially crafted monitor map monmap that advertises zero monitors. This malformed monmap is incorrectly processed as valid, which can lead to a client crash when attempting to open a session. This...

CVE-2026-68152

A flaw was found in the Linux kernel's AMT Accelerated Mobile Page device driver. A use-after-free vulnerability can occur due to a race condition during device removal. This allows delayed work items to access a freed memory structure, potentially leading to kernel crashes or memory corruption. ...

CVE-2026-68162

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. This Use-After-Free UAF vulnerability occurs during network namespace netns teardown. A local attacker with the ability to open a sysctl file could exploit this flaw, potentially leading to a...

CVE-2026-68193

A flaw was found in the Linux kernel. The mt7925 Wi-Fi driver incorrectly dispatches a memory-mapped I/O MMIO specific event to non-MMIO buses, such as USB. This improper handling leads to a NULL pointer dereference when attempting to clean up DMA transmit queues. A remote attacker could exploit...

CVE-2026-68157

A flaw was found in libceph, a component of the Linux kernel. When processing a malformed CRUSH map, if a parent bucket's name exists but its type is missing, a null pointer dereference can occur. This issue can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-68156

A flaw was found in the libceph component of the Linux kernel. During an authorizer update, if the authorizer is rebuilt, a stale pointer to a freed memory region can be retained. A remote attacker could exploit this by triggering a specific network reconnection, leading to a use-after-free...

CVE-2026-68257

A flaw was found in the Linux kernel's drm/amdkfd component. An integer overflow vulnerability exists in the calculation of a memory allocation size. When processing large input values, this calculation can result in an undersized memory region, which can then be overrun by firmware. This could...

CVE-2026-68160

A flaw was found in the Linux kernel's Ceph component. A remote attacker could exploit this by sending a specially crafted message with a manipulated snaptracelen value. This pre-authentication vulnerability allows for an out-of-bounds read, potentially leading to information disclosure or a deni...

CVE-2026-68196

A flaw was found in the Linux kernel's wilc1000 Wi-Fi driver. This vulnerability occurs when processing a malformed association response, where the length of the response is not properly validated before calculating the length of trailing information elements. A remote attacker could send a...

CVE-2026-68424

A flaw was found in the Linux kernel's mtdvirtconcat module. This use-after-free vulnerability occurs when the mtdconcatdestroy function frees memory before it is no longer referenced by mtdvirtconcatputmtddevices. An attacker could potentially exploit this flaw to cause memory corruption, which...

CVE-2026-68343

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System DFS referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds...

CVE-2026-68325

A flaw was found in the Linux kernel's ivrsacpihid command-line parser. This vulnerability occurs because the parser does not properly bound the earlyacpihidmap array, allowing it to append more entries than its fixed four-element capacity. A local attacker could exploit this out-of-bounds write ...

CVE-2026-68345

A flaw was found in the Linux kernel's armmpam component. When destroying component configuration, the destroycomponentcfg function attempts to add mbwustate objects to a garbage list. However, some Root Interrupt Systems RISes may have a NULL mbwustate object, leading to a null pointer dereferen...

CVE-2026-68279

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. A malicious or misbehaving MST hub could send a specially crafted sideband message that causes an out-of-bounds read in the drmdpsidebandparseremotedpcdread and drmdpsidebandparseremotei2creadack functions...

CVE-2026-68305

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. This vulnerability arises when graphics buffer objects are deallocated prematurely while the DRM structure remains active. This can lead to a null pointer dereference when the system attempts to access these freed...

CVE-2026-68395

A flaw was found in the Linux kernel's satadwc460ex driver. During the SATA controller's initialization, interrupts are enabled before the corresponding interrupt handler is fully registered. This timing issue can lead to a spurious interrupt storm if an interrupt occurs prematurely or if...

CVE-2026-68428

A flaw was found in the KVM Kernel-based Virtual Machine component of the Linux kernel. A local attacker with privileges to load and unload kernel modules could exploit a use-after-free vulnerability. This occurs when a vendor module is unloaded while the KVM module remains loaded, and a subseque...

CVE-2026-68400

A flaw was found in the Linux kernel's armffa firmware component. An incorrect calculation of the Endpoint Memory Access Descriptor offset could lead to improper memory access. This issue arises from defaulting to a fixed size instead of using the descriptor's specified offset, potentially causin...

CVE-2026-68397

A flaw was found in the Linux kernel's net/iucv module. The afiucvhsrcv function fails to properly manage socket references. This allows a local attacker to trigger a use-after-free vulnerability by concurrently closing a socket while it is being processed. Successful exploitation can lead to a...

CVE-2026-68319

A flaw was found in the pdscore component of the Linux kernel. This vulnerability involves a deadlock condition that can occur when the pciresetfunction and pdscremove functions are called concurrently. This can cause the system to become unresponsive, leading to a denial of service...