CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

CVE-2026-68474 powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68471 wifi: ieee80211: validate MLE common info length

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

EUVD-2026-59090

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

CVE-2026-68468 mtd: virt-concat: free duplicate generated name

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

CVE-2026-68468 mtd: virt-concat: free duplicate generated name

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

CVE-2026-68468

The CVE affects the Linux kernel MTD virt-concat path. The root cause is that after a virtual concat is already registered, mtd_virt_concat_create_join() builds the same name again and follows the equal-name branch, skipping the cleanup of the newly allocated temporary string. The vulnerability i...

CVE-2026-68468

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

CVE-2026-68467

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

CVE-2026-68466

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...

CVE-2026-68465

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...

CVE-2026-68464

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt When using WIFI out-of-band wakeup, an "irq xxx: nobody cared" warning occurs. This happens because the usdhc interrupt is not disabled during system...

CVE-2026-68463

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: use pmruntimeresumeandget in suspend Replace pmruntimegetsync with pmruntimeresumeandget to simplify error handling. pmruntimeresumeandget automatically drops the usage counter on failure, avoiding the need...

CVE-2026-68461

In the Linux kernel, CVE-2026-68461 is resolved by fixing fwnode_init() so that fwnode_handle and its secondary pointer are initialized (setting fwnode->secondary to NULL and initializing remaining fields). This prevents a firmware node allocated on stack/heap with non-zeroing allocation from ...

CVE-2026-68461 device property: initialize the remaining fields of fwnode_handle in fwnode_init()

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...

EUVD-2026-59083

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...