UBUNTU-CVE-2026-68415

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

EUVD-2026-55606

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

EUVD-2026-55601

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68415

The CVE-2026-68415 entry documents a Linux kernel xfrm (IPSec) flaw where xfrm_state_gc_task can dereference stale mode_cbs after a failed IPTFS state setup and subsequent module unload. The root cause is failing to clear x->mode_cbs before publishing mode_data, allowing deferred GC to access ...

CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

EUVD-2026-55427

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-68304 wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

CVE-2026-68298

CVE-2026-68298 concerns the Linux kernel drm/xe/vm code. The vulnerability stems from an error path where, after a failed drm_gpuvm_resv_object_alloc(), resources allocated by xe_svm_init() could leak because xe_svm_fini() and xe_svm_close() were not always invoked for non-fault-mode VMs. The fix...

CVE-2026-68256 drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

CVE-2026-68256

Summary: CVE-2026-68256 affects the Linux kernel DRM/AMD Display stack, specifically the function detect_link_and_local_sink. The issue: on the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT, prev_sink is not released, whereas all other paths correctly call dc_sink_release(prev_sink). T...

CVE-2026-68184

The CVE-2026-68184 issue affects the Linux kernel CD-ROM code, specifically mmc_ioctl_cdrom_volume for CDROMVOLCTRL. A 32-byte stack buffer is used to read the audio control mode page (buflen 24, then extended if a block descriptor is present). The function later builds a MODE SELECT payload by m...

EUVD-2026-55285

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

CVE-2026-68184 cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

In the Linux kernel, the following vulnerability has been resolved: cdrom: fix stack out-of-bounds read in CDROMVOLCTRL mmcioctlcdromvolume first reads the audio control mode page into a 32-byte stack buffer with cgc-buflen set to 24. If the device reports a block descriptor, the function increas...

AZL-94695 CVE-2026-66484 affecting package cpio for versions less than 2.14-2

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

DEBIAN-CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

Open WebUI: Users denied the image-generation permission can still generate images via chat completions

SummaryAn authenticated user whose features.imagegeneration permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission...

Keras: Lambda deserialization can bypass safe mode and execute code

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

PYSEC-2026-3631 Keras: Lambda deserialization can bypass safe mode and execute code

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the Lambda layer. Specifically, the raiseforlambdadeserialization function fails to enforce the safe-mode guard when safemode is set to None, which is the default...

Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...