EUVD-2026-55471

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummyhcd: prevent fiforeq reuse during giveback dummyhcd embeds a single shared usbrequest dum-fiforeq that the "emulated single-request FIFO" fast-path in dummyqueue reuses for small IN transfers: it copies the...

EUVD-2026-55467

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: clamp SENDRESPONSE length to the response buffer uvcsendresponse builds the UVC control response from a user-supplied struct uvcrequestdata: req-length = mintunsigned int, uvc-eventlength, data-length;...

CVE-2026-68324 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeoflstat DMARLATENCYNUM, which...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

EUVD-2026-55400

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

CVE-2026-68263

CVE-2026-68263 affects the Linux kernel’s drm/imagination component. The issue is a double call to drm_sched_entity_fini() during a two-step destruction path, causing a refcount underflow and use-after-free. Root cause: drm_sched_entity_fini() is invoked both from pvr_context_kill_queues() path a...

CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

EUVD-2026-55353

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68250

In the Linux kernel component drm/amdgpu/sdma5.2, CVE-2026-68250 addresses a path where a BUG_ON() could crash the kernel. The vulnerability is resolved by replacing BUG_ON() with WARN_ON(), avoiding a kernel crash in these cases. The fix was cherry-picked from commit ae658afc7f47f6147371ec42cc6b...

CVE-2026-68249 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

EUVD-2026-55347

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68203 media: vivid: fix cleanup bugs in vivid_init()

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

CVE-2026-68202

CVE-2026-68202 affects the Linux kernel’s ALSA sequencer. A race in queue timer cleanup allows an unprivileged local user with access to /dev/snd/seq to re-open a timer that has just been closed, leading to a use-after-free of the timer/queue object and a potential crash or, in theory, arbitrary ...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68144

The CVE-2026-68144 issue is in the Linux kernel Phonet subsystem (pep_get_sb). The root cause is use-after-free caused when pep_get_sb() doesn’t account for skb data relocation by pskb_may_pull(), leading to a stale pointer dereference. Reproductions via KASAN show slab-use-after-free in pep_get_...

CVE-2026-68115

The CVE-2026-68115 entry relates to the Linux kernel DRM/AMDGPU gfx10 driver. The issue was that BUG_ON() caused a kernel crash and has been replaced with WARN_ON(), so the code no longer forces a crash in these cases. This is a code fix (cherry-picked from commit ac6f00beb658239bced4aaed9efbb04a...