EUVD-2026-55453

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68352

CVE-2026-68352 concerns the Linux kernel’s ath6kl Wi‑Fi driver. The vulnerability arises from insufficient validation of firmware‑controlled IE lengths (beacon_ie_len, assoc_req_len, assoc_resp_len) in ath6kl_wmi_connect_event_rx(), allowing a total IE length up to 765 to exceed the actual WMI ev...

CVE-2026-68352 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

CVE-2026-68339

The Linux kernel Bluetooth btusb vulnerability CVE-2026-68339 stems from btusb_recv_event_realtek() inspecting data[0] and data[2] before verifying the HCI event header and first parameter. This can cause misclassification of a vendor event as a coredump (e.g., a 2-byte event ff 00 with adjacent ...

CVE-2026-68326 wifi: mwifiex: bound uAP association event IEs to the event buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-68326

CVE-2026-68326 affects the Linux kernel mwifiex Wi‑Fi driver. A malicious or malfunctioning device in AP/uAP mode can supply a crafted EVENT_UAP_STA_ASSOC with an invalid event length. The code derives sinfo->assoc_req_ies_len from event->len without proper validation, causing potential sla...

EUVD-2026-55384

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

CVE-2026-68283 tracing: Fix use-after-free freeing trigger private data

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

EUVD-2026-55360

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68259 drm/amdkfd: Check bounds in allocate_event_notification_slot

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68259

CVE-2026-68259 affects the Linux kernel's DRM/amdkfd path, specifically allocate_event_notification_slot. The vulnerability arises from not validating the upper bound of user-supplied event IDs used by CRIU; valid IDs are 0 to KFD_SIGNAL_EVENT_LIMIT. The fix adds bounds checks, ensuring the upper...

CVE-2026-68177 tracing: Delay module ref count for "enable_event" trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

CVE-2026-68177

The CVE-2026-68177 entry describes a Linux kernel tracing vulnerability in which delaying the release of a module that contains an active enable/disable event leads to use-after-free if the module is removed while still referenced by an event. The underlying issue is that the module refcount is r...

EUVD-2026-55278

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

CVE-2026-68174

The vulnerability CVE-2026-68174 affects the Linux kernel tracing subsystem. In struct trace_event_call, the module pointer and the refcnt atomic share a union, so for dynamic events (kprobe, uprobe, fprobe, eprobe, wprobe) the refcnt may be non-zero and cause call->module to appear as a small...

EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

EUVD-2026-55538

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

EUVD-2026-55528

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...