CVE-2026-68193 wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68191 wifi: ath12k: fix NULL pointer dereference in rhash table destroy

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

CVE-2026-68181

In the Linux kernel, CVE-2026-68181 affects the mei bus cleanup path. The vulnerability arises in mei_cl_bus_dev_release() where mei_cl_flush_queues() runs without holding a lock, and subsequent access to bus->file_list after mei_dev_bus_put(bus) can lead to a use-after-free if it was the last...

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

EUVD-2026-55282

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

EUVD-2026-55556

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68170

CVE-2026-68170, affecting Linux kernel MPTCP, describes a use-after-free risk caused by a stale backlog backlog entry referencing a closing subflow. The issue arises because backlog cleanup was performed in mptcp_close_ssk() without holding the ssk lock or mptcp_data_lock(), while concurrent RX p...

EUVD-2026-55483

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to always return false, so iounmapaperbasekaddr never runs on normal driv...

EUVD-2026-55476

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68084 staging: vme_user: fix location monitor leak in tsi148 bridge

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

SummaryA user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied ...

PYSEC-2026-3648 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

CVE-2026-19404

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...

CVE-2026-68382: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

PT-2026-76481

Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-68203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized...

PT-2026-69485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the vme user staging driver within the tsi148 bridge. The tsi148 probe function allocates a location monitor resource and adds it to the lm resources list of the...