UBUNTU-CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

UBUNTU-CVE-2026-68313

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

UBUNTU-CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

UBUNTU-CVE-2026-68370

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummyhcd: prevent fiforeq reuse during giveback dummyhcd embeds a single shared usbrequest dum-fiforeq that the "emulated single-request FIFO" fast-path in dummyqueue reuses for small IN transfers: it copies the...

CVE-2026-68132

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

EUVD-2026-55596

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

CVE-2026-68377

CVE-2026-68377 affects the Linux kernel net/sched component, specifically act_tunnel_key. The issue is a race leading to use-after-free during tunnel_key_release_params() where metadata_dst is released synchronously via dst_release() while the old params are freed with kfree_rcu(), allowing a con...

CVE-2026-68377 net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

EUVD-2026-55563

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68375

The CVE affects bnxt_en in the Linux kernel. bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. If allocation fails after auxiliary_device_init(), the release path can dereference or clear partially initialized state. The fix is...

CVE-2026-68375 bnxt_en: Handle partially initialized auxiliary devices

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68370

CVE-2026-68370 affects the Linux kernel USB gadget dummy_hcd path. A race condition reuses a shared usb_request (fifo_req) before its completion callback finishes, allowing overwriting of the callback pointer and causing a general protection/page fault in dummy_timer. The mitigation adds a fifo_r...

EUVD-2026-55466

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68363

The CVE affects the Linux kernel ath9k wireless driver (ath9k_htc) in the hif_usb path. The vulnerability arises when an asynchronous firmware load is re-armed via request_firmware_nowait(), which passes hif_dev as the completion context and later dereferences hif_dev in a post-request dev_info()...

CVE-2026-68351

The CVE-2026-68351 entry describes a Linux kernel issue in the wifi carl9170 driver where a command-response length mismatch could cause an out-of-bounds read. The bug occurred because carl9170_cmd_callback() could fall through to memcpy(ar->readbuf, buffer + 4, len - 4) with len derived from ...

CVE-2026-68351 wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

EUVD-2026-55319

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove callback to free its resources, thus fixing memory leak...