CVE-2026-68180

CVE-2026-68180: In the Linux kernel intel_th MSC output path, a reference leak occurred. intel_th_output_open() selects the output device via bus_find_device_by_devt(), which returns a device reference that must be dropped. The release path for MSC outputs, intel_th_msc_release(), only removed th...

CVE-2026-68180 intel_th: fix MSC output device reference leak

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...

CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

CVE-2026-68179

CVE-2026-68179 affects the Linux kernel NSM: nsm_dev_ioctl() may unlock a mutex that was never acquired when pre-lock copy_from_user() fails, risking a local DoS. A patch changes control flow to return immediately on pre-lock failures and to keep the unlock path for post-lock errors only. The vul...

CVE-2026-68178 misc: nsm: pin the module while the device is open

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

EUVD-2026-55279

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

CVE-2026-68178 misc: nsm: pin the module while the device is open

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

CVE-2026-68178

CVE-2026-68178 concerns the Linux kernel NSM (Network Shared Memory) misc device. The root cause is that misc_open() installs file_operations with fops_get() which pins file_operations::owner, but NSM’s misc device left nsm_dev_fops.owner unset, allowing an open /dev/nsm descriptor to survive an ...

CVE-2026-68176 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

EUVD-2026-55277

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

CVE-2026-68176

The CVE-2026-68176 entry concerns the Linux kernel tracing subsystem (mmiotrace) where a NULL dereference could occur if mmio_pipe_open() fails to locate a PCI device and hiter->dev is NULL. The read() path previously dereferenced hiter->dev without verifying it; the fix adds a check for hi...

CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

EUVD-2026-55274

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173

CVE-2026-68173 affects the Linux kernel ublk subsystem. The root cause is that ub->completion is an edge-triggered latch used as a proxy for the readiness condition; when a server sends END_USER_RECOVERY without a preceding START_USER_RECOVERY, the wait can be satisfied by a stale completion, ...

EUVD-2026-55549

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68163

The CVE-2026-68163 entry concerns Linux kernel memory management: device-private PMD handling in page_vma_mapped_walk() and related code paths. Root cause was improper handling of device-private PMD entries after adding device-private support, leading to cases where PMD entries with PFNs could be...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68152

The CVE-2026-68152 issue affects the Linux kernel AMT driver. A race during device removal can let delayed works access freed amt_dev memory, risking kernel crashes or memory corruption.Root cause: pending delayed works may be re-queued after cancellation (amt_dev_stop) via event_wq, accessing fr...