DEBIAN-CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

UBUNTU-CVE-2026-68235

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...

UBUNTU-CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

UBUNTU-CVE-2026-68271

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

EUVD-2026-55372

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68261

Technical details about CVE-2026-68261 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-68261 drm/imagination: fix error checking of pvr_vm_context_lookup()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68261 drm/imagination: fix error checking of pvr_vm_context_lookup()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68235

The CVE refers to drm/amd/display (dce100) in the Linux kernel. Root cause: when assigning a stream encoder for a second DisplayPort MST stream on DCE8-class ASICs, if the preferred digital encoder is already acquired, the code can fall back to an analog DAC encoder whose funcs table lacks DP hoo...

CVE-2026-68235 drm/amd/display: dce100: skip non-DP stream encoders for DP MST

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...

CVE-2026-68194 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA tx queues with...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ceph: Fix for oops due to invalid pointer for kfree in parselongname This fix addresses a kernel oops that occurs when reading ceph snapshot directories .snap, for example, by simply running ls /mnt/myceph/.snap. The variable str...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: APEI/GHES: Ensure that the allocated size does not exceed CPER. The logic in ghesnew prevents allocating too large records by checking whether they are larger than GHESESTATUSMAXSIZE currently 64KB. However, the allocation is sti...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: APEI/GHES: ARM processor Error: Do not go beyond the allocated memory If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err-sectionlength and ctxinfo-size...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Pass netdev to mlx5edestroynetdev instead of priv mlx5epriv is an unstable structure that can be memset0 if profile attachment fails. Pass netdev to mlx5edestroynetdev to ensure that it works with a valid netdev. On...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/mlx5e: Do not store mlx5epriv in mlx5edev devlink priv mlx5epriv is an unstable structure that can be memset0 if profile attachment fails. mlx5epriv in mlx5edev devlink private is used to reference the netdev and mdev...

CVE-2026-64297

A flaw was found in the Linux kernel. An unchecked return value in the moduleextendmaxpages function within the module decompression logic can lead to a null pointer dereference. This vulnerability can be triggered if memory allocation fails during module loading, resulting in a kernel oops. This...

CVE-2026-64538

CVE-2026-64538 concerns a Linux kernel vulnerability where fib6_nh_mtu_change() dereferences idev->cnf.mtu6 after re-fetching idev with __in6_dev_get(arg->dev) without a NULL check. This can occur because addrconf_ifdown() clears dev->ip6_ptr after tb6_lock is released, allowing an RA-dr...

CVE-2026-64297

Summary (CVE-2026-64297): The Linux kernel vuln arises from not checking the return value of module_extend_max_pages() inside the decompression path. When initial allocation fails, info->pages is NULL and info->max_pages is 0. Subsequent calls to module_get_next_page() may call module_exten...