CVE-2026-68212

The CVE affects the Linux kernel driver media: saa7134, specifically saa7134_video_init1. The issue is a memory leak risk caused by missing return-value checks on two saa7134_pgtable_alloc() calls and incomplete error handling when vb2_queue_init() for the VBI queue fails. If a pgtable allocation...

CVE-2026-68208

The CVE concerns the Linux kernel code in media: TI: VPE. In vip_probe_slice(), the error handling for devm_kzalloc() used PTR_ERR_OR_ZERO(), which incorrectly returns 0 on NULL and fails to signal allocation failure. The vulnerability is addressed by returning -ENOMEM when devm_kzalloc() fails. ...

EUVD-2026-55309

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devmkzalloc in vipprobeslice In vipprobeslice, the error check for devmkzalloc incorrectly uses PTRERRORZERO which returns 0 for NULL pointer. Return -ENOMEM for devmkzalloc failure...

EUVD-2026-55300

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

CVE-2026-68199 wifi: ath6kl: fix OOB access from firmware ADDBA window size

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB access from firmware ADDBA window size aggrrecvaddbareqevt logs a debug message when the firmware-supplied winsz is outside AGGRWINSZMIN, AGGRWINSZMAX but does not return. The out-of-range winsz is then used...

EUVD-2026-55284

In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix memory leaks and list corruption bugs Fix a memory leak when genpoolalloc fails by freeing pmem on the error path. Switch pmem allocation from devmkzalloc to kzalloc with explicit kfree in the free pa...

CVE-2026-68183 firmware: stratix10-svc: fix memory leaks and list corruption bugs

In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix memory leaks and list corruption bugs Fix a memory leak when genpoolalloc fails by freeing pmem on the error path. Switch pmem allocation from devmkzalloc to kzalloc with explicit kfree in the free pa...

CVE-2026-68175 tracing: Fix resource leak on mmiotrace trace_pipe close

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

CVE-2026-68147 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68147

Summary: CVE-2026-68147 affects the Linux kernel fscrypt subsystem. When a blk_crypto_key is evicted, the code previously allocated a list of block devices on the heap; allocation failures could lead to premature key free and a use-after-free. The fix switches to an on-stack array to enumerate bl...

CVE-2026-68147 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68141

The CVE-2026-68141 issue affects the Linux kernel’s af_iucv path. afiucv_hs_callback_syn() may allocate a child socket; if allocation fails, nsk becomes NULL and the code may call iucv_sock_kill(nsk), which dereferences a NULL pointer. The result is a NULL pointer dereference causing a system cra...

EUVD-2026-55523

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68129 gve: fix Rx queue stall on alloc failure

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

CVE-2026-68129 gve: fix Rx queue stall on alloc failure

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

CVE-2026-68106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

CVE-2026-68087

CVE-2026-68087 affects the Linux kernel HID wacom driver. The vulnerability stems from using GFP_KERNEL inside wacom_wac_queue_flush(), which is invoked from the atomic-context, URB-completion path (hid_irq_in()) via wacom_raw_event → wacom_wac_pen_serial_enforce → wacom_wac_queue_flush. Using GF...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

CVE-2026-66485

GNU cpio is vulnerable to an uncontrolled memory allocation in the makepath function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a...

CVE-2026-59088

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...