CVE-2026-68384 drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

EUVD-2026-55570

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

EUVD-2026-55470

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...

CVE-2026-68362 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

EUVD-2026-55457

In the Linux kernel, the following vulnerability has been resolved: watchdog: airoha: Prevent division by zero when clock frequency is zero clkgetrate can return 0 when the clock provider is not properly configured or the clock is unmanaged. The driver uses wdtfreq as a divisor directly in...

CVE-2026-68356

The CVE applies to the Linux kernel watchdog driver for the Airoha clock, where clk_get_rate() can return 0 if the clock is unmanaged or misconfigured. The driver uses wdt_freq as a divisor in airoha_wdt_probe() (to compute max_timeout) and in airoha_wdt_get_timeleft() (to compute remaining time)...

CVE-2026-68350 wifi: carl9170: fix OOB read from off-by-two in TX status handler

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two, allowing 2 extra iterations past valid txstatus entries when the...

CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68313 tipc: fix infinite loop in __tipc_nl_compat_dumpit

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

CVE-2026-68313

The CVE-2026-68313 entry concerns a Linux kernel tipc issue where a negative return from the cmd->dumpit callback could cause an infinite loop in the __tipc_nl_compat_dumpit code path, because the while (len) loop never terminates and the genl_mutex is not released. The vulnerability is resolv...

EUVD-2026-55414

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

CVE-2026-68298 drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...

CVE-2026-68291

CVE-2026-68291 covers a Linux kernel fix for the idpf driver: max_vports is now set only after successful allocation of vports, netdevs, and vport_config buffers, preventing crashes on reset or rmmod after a failed init. The description documents a kernel NULL pointer dereference in idpf_remove d...

CVE-2026-68291 idpf: fix max_vport related crash on allocation error during init

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

CVE-2026-68282 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

CVE-2026-68275

The CVE-2026-68275 entry concerns the Linux kernel DRM/AMDGPU driver. In the AMDGPU GEM GET_MAPPING_INFO path, amdgpu_gem_op_ioctl() looks up the BO in the caller’s VM via amdgpu_vm_bo_find() but does not verify the returned pointer before using it. If no bo_va exists for the BO in that VM (the n...

EUVD-2026-55372

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68268 drm/xe: Return error on non-migratable faults requiring devmem

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...