CVE-2026-68203

A flaw was found in the Linux kernel's vivid media driver. This vulnerability involves two cleanup bugs within the vividinit function. Firstly, a reference leak occurs if platformdeviceregister fails, preventing the proper release of device resources. Secondly, an incorrect function call during...

CVE-2026-68189

A flaw was found in the Bluetooth hcisync component of the Linux kernel. A race condition during the UUID list traversal, caused by improper synchronization between asynchronous command sync work and UUID list updates, can lead to a use-after-free vulnerability. This could allow a local attacker ...

CVE-2026-68153

A flaw was found in the Linux kernel's libceph component. During the process of tearing down a client, the monitor client is stopped before its associated debugfs files are removed. This timing issue allows a concurrent read of the monmap debugfs file to access memory that has already been freed,...

CVE-2026-68195

A flaw was found in the Linux kernel's mt76 Wi-Fi driver, specifically affecting the mt7615 component. This vulnerability occurs because a memory-mapped I/O MMIO specific event, PKTTYPETXRXNOTIFY, is incorrectly processed on non-MMIO buses such as USB and SDIO. When this event is dispatched, it...

CVE-2026-68390

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hcisync component. This vulnerability occurs because the hciconnparamslookup function does not properly hold a necessary lock hdev-lock during operations. This oversight can lead to unsafe list iterations or...

CVE-2026-68158

A flaw was found in libceph within the Linux kernel. A remote attacker could send a maliciously crafted CEPHMSGOSDMAP message, leading to a multiplication overflow in the decodenewupstateweight function. This overflow causes an incorrect bounds check, which may result in out-of-bounds memory read...

CVE-2026-68293

A flaw was found in the net/mlx5 driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the mcia32dwords capability, the mlx5querymcia function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause...

CVE-2026-68420

A flaw was found in the Linux kernel's xfrm component. A local user could trigger a stack-out-of-bounds read by configuring an outbound Internet Protocol Security IPsec policy with optional IPsec Flow Template Specification IPTFS templates. This vulnerability can lead to a system crash, resulting...

CVE-2026-68169

A flaw was found in the Linux kernel's Multipath TCP MPTCP subsystem. A race condition in the mptcppmuserspacegetlocalid function allows a memory address entry to be freed while still being referenced. A local attacker could exploit this use-after-free vulnerability, potentially leading to a syst...

CVE-2026-68298

A flaw was found in the Linux kernel's drm/xe/vm module. During the creation of a virtual machine VM, an error in resource allocation could lead to a Shared Virtual Memory SVM resource leak. This occurs because the kernel's resource deallocation functions are not consistently called when an error...

CVE-2026-68165

A flaw was found in the Linux kernel's Data Access MONitor DAMON core logic. A local user could exploit this by providing invalid, zero-length memory region ranges through DAMON's application programming interface API callers. This improper input validation can lead to a divide-by-zero error,...

CVE-2026-68297

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication module. A local user can exploit this vulnerability by providing a crafted Maximum Transmission Unit MTU value that exceeds the expected limit. This can lead to a division-by-zero error, causing a system crash and...

CVE-2026-68173

A flaw was found in the ublk component of the Linux kernel. This vulnerability occurs when the ublk server sends an ENDUSERRECOVERY command without a successful STARTUSERRECOVERY. This can cause I/O requests to become stranded, leading to subsequent file system synchronization operations fsync to...

CVE-2026-68280

A flaw was found in the Linux kernel's drm/bridge: cdns-dsi component. This vulnerability arises from the incorrect use of a deprecated power management function, causing the system to attempt to disable DSI Display Serial Interface clocks twice during suspend operations. This redundant action...

CVE-2026-68095

A flaw was found in fuse-uring in the Linux kernel. A race condition exists between the registration of an I/O operation and the abortion of a FUSE connection. This can be triggered by a local attacker or a malicious application. This flaw can cause the unmount thread to hang indefinitely, leadin...

CVE-2026-68370

A flaw was found in the Linux kernel's USB gadget dummy Host Controller Driver HCD. A race condition can occur when a shared USB request object fiforeq is prematurely reused before its completion callback has finished. This can lead to the overwriting of the callback pointer, causing a general...

CVE-2026-68386

A flaw was found in the Linux kernel. A local attacker with BPF program capabilities could exploit a vulnerability in the BPF sockmap feature. This occurs when a BPF program increments the reference count of an unbound UDP socket, and the socket is subsequently bound. This sequence of events caus...

CVE-2026-68340

A flaw was found in the Linux kernel's hwmon OCC OpenPOWER Abbreviated Command and Control poll response parser. This vulnerability occurs because the parser incorrectly uses a static array capacity as the boundary for sensor data blocks instead of the actual data length. A specially crafted,...

CVE-2026-68094

A flaw was found in the Linux kernel's schedext component. When a task is moved to a local dispatch queue DSQ, the run queue rq tracking mechanism may not correctly follow lock switches. This inconsistency can lead to a kernel assertion failure, potentially causing system instability or a denial ...

CVE-2026-68302

A flaw was found in the Linux kernel's Adjacency Management Protocol AMT implementation. Several AMT receive and transmit paths improperly cache pointers to socket buffer skb headers. When a helper function reallocates the skb head, these cached pointers become invalid, leading to a use-after-fre...