CVE-2026-68357

The CVE pertains to the Linux kernel watchdog subsystem. It describes a use-after-free (UAF) that occurs when a watchdog governor is unregistered and the currently active governor is also the default_gov. In this case, the default_gov is not cleared, causing: (1) new watchdog devices to inherit a...

CVE-2026-68346

CVE-2026-68346 concerns the Linux kernel ALSA hda cs35l41 ACPI mute handling. The issue arises when cs35l41_get_acpi_mute_state() calls a _DSM method to obtain the ACPI mute state and reads the first byte of the returned object, but the returned ACPI object is not freed, causing a leak per query....

CVE-2026-68342

Technical details are not publicly available in the provided documents. No exposed affected products, versions, or exploit information is present; monitor for updates.

CVE-2026-68341

The CVE-2026-68341 entry documents a Linux kernel vulnerability in ovpn where unlock_ovpn() iterates a release_list with llist_for_each_entry() and calls ovpn_peer_put() inside the loop. If the last reference is dropped, the peer may be freed before the loop advances, leading to a use-after-free ...

CVE-2026-68335

CVE-2026-68335 affects the Linux kernel RDS path, where rds_find_bound() uses a global hash keyed only by (addr, port, scope_id). This allows a sender in one network namespace (netns A) to deliver to a socket in another netns (netns B), creating a use-after-free when the original connection is cl...

CVE-2026-68332

The CVE concerns a Linux kernel net/airoha issue where airoha_ppe_deinit() replaces the NPU pointer with NULL via rcu_replace_pointer() but does not wait for existing RCU readers, risking use-after-free when a reader still holds a reference. The fix adds synchronize_rcu() before ppe_deinit() to e...

CVE-2026-68321

CVE-2026-68321 affects the Linux kernel driver net: txgbe, addressing a FDIR filter leak that occurs on device removal. The issue arises when perfect FDIR filters are added while the interface is down and remain on the software list for later restore; unregister_netdev() only calls ndo_stop if th...

CVE-2026-68318

The CVE-2026-68318 entry concerns a Linux kernel use-after-free in pds_core during remove, caused by destroying the workqueue before pdsc_teardown() completes. The issue allows queued work on a destroyed workqueue via two paths: (1) a timeout in pdsc_teardown() -> pdsc_devcmd_reset() causes he...

CVE-2026-68302

The CVE affects the Linux kernel AMT paths where several receive/transmit handlers cache pointers into the skb head (e.g., ip_hdr(), ipv6_hdr(), eth_hdr(), and AMT headers) and then a later head reallocation can dangle the cached pointer. Affected sites include amt_rcv(), amt_dev_xmit(), amt_mult...

CVE-2026-68290

The CVE-2026-68290 issue affects the Linux kernel RDS TCP code. A race exists where rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() after the per-netns sysctl table is still registered. Because rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_lis...

CVE-2026-68285

The CVE concerns LoongArch BPF in the Linux kernel. Root cause: during JIT compilation, bpf_int_jit_compile() may return early on the first pass, leaving ctx->offset alive; if a later subprogram fails, bpf_jit_free() does not free jit_data->ctx.offset, causing a memory leak of the JIT conte...

CVE-2026-68283

CVE-2026-68283 is a Linux kernel tracing vulnerability fixed by delaying the freeing of event_trigger_data to a dedicated kthread via tracepoint_synchronize_unregister. The change removes prior inline synchronization from trigger_data_free(), causing a use-after-free if a concurrent tracepoint ha...

CVE-2026-68273

CVE-2026-68273 affects the drm/amdgpu component in the Linux kernel. The issue concerns context pstate override handling, particularly in amdgpu_ctx_init() and context exit, where the code did not reliably hold the adev->pm.stable_pstate_ctx_lock and could mismanage the stored override state. ...

CVE-2026-68266

CVE-2026-68266 affects the Linux kernel DRM/XE path: imported dma-buf BOs are created as sg BOs tied to the exporter’s resv, and if the importer hasn’t yet completed dma_buf_dynamic_attach, the exporter may be freed while the BO still references resv, causing a use-after-free. The fix holds a dma...

CVE-2026-68264

The CVE-2026-68264 issue affects the Linux kernel drm/xe/pt path. In xe_pt_update_ops_init(), current_op (and related state: needs_svm_lock, needs_invalidation) was not reset, so on retry paths (lock contention or OOM eviction) xe_pt_update_ops_prepare() runs again on the same vops and increments...

CVE-2026-68236

The CVE concerns the Linux kernel DRM/AMD Display path. In dm_update_crtc_state(), the skip_modeset path releases the dc_stream via dc_stream_release() but fails to NULL the new_stream pointer. If a subsequent error triggers a fail path, dc_stream_release() runs again on the dangling pointer, ris...

CVE-2026-68214

The CVE-2026-68214 issue affects the Linux kernel media/rtl2832 path and causes a use-after-free during module removal when a concurrent I2C transfer via the mux adapter is in flight. The root cause is that cancel_delayed_work_sync() is invoked before i2c_mux_del_adapters(), allowing rtl2832_dese...

CVE-2026-68202

The CVE describes a vulnerability in the Linux kernel ALSA seq subsystem where a re-opened queue timer can be re-created after queue destruction. Specifically, queue_delete() frees the timer after closing it, but snd_seq_timer_delete() may leave an active instance if the window between close and ...

CVE-2026-68201

ALSA timer use-after-free in the Linux kernel (CVE-2026-68201): when a master timer is closed, the slaves’ callbacks could still be running and be freed underneath them. The fix drains the slaves’ callbacks before remove_slave_links(), removes slaves from the ack list, and waits for in-flight cal...

CVE-2026-68200

The Linux kernel ALSA timer vulnerability CVE-2026-68200 allows a use-after-free when a utimer callback is still running and a second interrupt re-queues the same instance. The fix prevents re-queuing an in-flight callback by not adding it (and its slaves) to the ack/sack list while the callback ...