CVE-2026-68317 pds_core: fix auxiliary device add/del races

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix auxiliary device add/del races Two paths add or delete the same slot pf-vfsvfid.padev: a VF's pdscresetdone and the PF's devlink enablevnet/disablevnet handler. They serialize on configlock, but neither guards the sl...

CVE-2026-68310 wifi: mt76: mt7915: guard HE capability lookups

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915mcubsshetlv and mt7915mcustabfertlv both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap. That helper can return NULL...

CVE-2026-68309 wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68307 wifi: mt76: mt7925: fix crash in reset link replay

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

EUVD-2026-55407

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68305 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

EUVD-2026-55406

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

CVE-2026-68282

In the Linux kernel DRM/rockchip stack (analogix_dp), a missing error check for platform_get_resource() return value could lead to a NULL pointer dereference if memory resource is unavailable. The provided descriptions indicate this has been resolved by adding the necessary error check. No exploi...

EUVD-2026-55383

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68261 drm/imagination: fix error checking of pvr_vm_context_lookup()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68260

The CVE-2026-68260 issue concerns the Linux kernel DRM Imagination driver. The drm_gpuvm code did not protect find operations against map operations, allowing a find in progress to run during map/unmap and potentially dereference NULL pointers. The workaround/fix introduced is to have pvr_vm_map(...

CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

EUVD-2026-55344

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68235 drm/amd/display: dce100: skip non-DP stream encoders for DP MST

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...

CVE-2026-68225 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

EUVD-2026-55298

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

CVE-2026-68195 wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

EUVD-2026-55292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...