CVE-2026-68184

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68178

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

UBUNTU-CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

UBUNTU-CVE-2026-68400

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

UBUNTU-CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

CVE-2026-68100

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

UBUNTU-CVE-2026-68129

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

EUVD-2026-55586

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68374

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously freed in usbresetandverifydevice, a function that is commonly called i...

CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

EUVD-2026-55445

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

CVE-2026-68344 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

CVE-2026-68344 usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

EUVD-2026-55285

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68184

The CVE-2026-68184 issue affects the Linux kernel CD-ROM code, specifically mmc_ioctl_cdrom_volume for CDROMVOLCTRL. A 32-byte stack buffer is used to read the audio control mode page (buflen 24, then extended if a block descriptor is present). The function later builds a MODE SELECT payload by m...

CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68178

CVE-2026-68178 concerns the Linux kernel NSM (Network Shared Memory) misc device. The root cause is that misc_open() installs file_operations with fops_get() which pins file_operations::owner, but NSM’s misc device left nsm_dev_fops.owner unset, allowing an open /dev/nsm descriptor to survive an ...