UBUNTU-CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

UBUNTU-CVE-2026-68272

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

UBUNTU-CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68306

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

UBUNTU-CVE-2026-68362

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

UBUNTU-CVE-2026-68194

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA tx queues with...

UBUNTU-CVE-2026-68291

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

CVE-2026-68195

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7615rxcheck and mt7615queuerxskb dispatch it to mt7615mactxfree on every bus. mt7615mactxfree cleans the DMA tx queues with...

CVE-2026-68193

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

UBUNTU-CVE-2026-68243

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

UBUNTU-CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

UBUNTU-CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

UBUNTU-CVE-2026-68197

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

CVE-2026-68307

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

UBUNTU-CVE-2026-68345

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

UBUNTU-CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

UBUNTU-CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...