CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

CVE-2026-68263

CVE-2026-68263 affects the Linux kernel’s drm/imagination component. The issue is a double call to drm_sched_entity_fini() during a two-step destruction path, causing a refcount underflow and use-after-free. Root cause: drm_sched_entity_fini() is invoked both from pvr_context_kill_queues() path a...

EUVD-2026-55353

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68250

In the Linux kernel component drm/amdgpu/sdma5.2, CVE-2026-68250 addresses a path where a BUG_ON() could crash the kernel. The vulnerability is resolved by replacing BUG_ON() with WARN_ON(), avoiding a kernel crash in these cases. The fix was cherry-picked from commit ae658afc7f47f6147371ec42cc6b...

CVE-2026-68249 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

EUVD-2026-55347

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68203 media: vivid: fix cleanup bugs in vivid_init()

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

CVE-2026-68202

CVE-2026-68202 affects the Linux kernel’s ALSA sequencer. A race in queue timer cleanup allows an unprivileged local user with access to /dev/snd/seq to re-open a timer that has just been closed, leading to a use-after-free of the timer/queue object and a potential crash or, in theory, arbitrary ...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68144

The CVE-2026-68144 issue is in the Linux kernel Phonet subsystem (pep_get_sb). The root cause is use-after-free caused when pep_get_sb() doesn’t account for skb data relocation by pskb_may_pull(), leading to a stale pointer dereference. Reproductions via KASAN show slab-use-after-free in pep_get_...

CVE-2026-68115

The CVE-2026-68115 entry relates to the Linux kernel DRM/AMDGPU gfx10 driver. The issue was that BUG_ON() caused a kernel crash and has been replaced with WARN_ON(), so the code no longer forces a crash in these cases. This is a code fix (cherry-picked from commit ac6f00beb658239bced4aaed9efbb04a...

EUVD-2026-55496

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

CVE-2026-68114 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23...

EUVD-2026-55492

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

EUVD-2026-55490

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

CVE-2026-68109

CVE-2026-68109 : In the Linux kernel’s drm/amdgpu/sdma7.1 path, the vulnerability was resolved by replacing a failing assertion: replace BUG_ON() with WARN_ON() so the kernel no longer crashes in these cases. The commit cherry-picks the fix (c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5). Affected com...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...