DEBIAN-CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

CVE-2026-68207

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpetop resource is missing, vpeprobe returns -ENODEV after v4l2deviceregister has succeeded. Probe failures do not call the driver's remove callback, so the v4...

CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68427 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1xboclearcachedmappings host1xbounpin drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cach...

CVE-2026-68425

CVE-2026-68425 concerns the Linux kernel InfiniBand MAD path (IB/mad). The vulnerability arises when kernel-handled RMPP receive processing begins reassembly for DATA responses before matching the response to an outstanding send, enabling a reordered burst to reach receive-side insertion without ...

CVE-2026-68330

CVE-2026-68330 relates to the Linux kernel net/airoha NPU mailbox handling. The issue arises because airoha_npu_send_msg() always maps the mailbox buffer with DMA_TO_DEVICE, while some callers expect the NPU to write the response back into the same buffer. On non‑cache‑coherent architectures (e.g...

CVE-2026-68309

The vulnerability CVE-2026-68309 affects the Linux kernel driver for wifi mt76 (Connac) and fixes a NULL-pointer dereference in mt76_connac_mcu_uni_bss_he_tlv(). The root cause is that mt76_connac_get_he_phy_cap could return NULL, and the code may dereference the cap pointer without checking. A p...

CVE-2026-68265

CVE-2026-68265 affects the Linux kernel, specifically the drm/xe/vm path. The issue arises when prefetching a BO VMA in the region DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC, where the code uses the value as an index into region_to_mem_type[], causing an out-of-bounds access (value is -1). The remediatio...

EUVD-2026-55338

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68208

The CVE concerns the Linux kernel code in media: TI: VPE. In vip_probe_slice(), the error handling for devm_kzalloc() used PTR_ERR_OR_ZERO(), which incorrectly returns 0 on NULL and fails to signal allocation failure. The vulnerability is addressed by returning -ENOMEM when devm_kzalloc() fails. ...

CVE-2026-68143

CVE-2026-68143 affects the Linux kernel SLIP path. A race between MTU changes and receive processing can occur because sl_realloc_bufs() updates rbuff and buffsize while holding sl->lock, but slip_receive_buf() may write to rbuff without the lock. An MTU change/shrink can expose the new smalle...

EUVD-2026-55526

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68135 net: hip04: fix RX buffer leak on build_skb failure

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...

CVE-2026-68118

The CVE-2026-68118 issue affects the Linux kernel TCP stack: the SYN-RECEIVED path tcp_check_req() accepted in-window non-exact RSTs without exact SEG.SEQ match, causing the request to be removed instead of issuing a challenge ACK. The fix enforces RFC 9293/5961 order by applying the RST check be...

CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68103 drm/amdgpu: reject mapping a reserved doorbell to a new queue

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68097

Summary: CVE-2026-68097 affects the Linux kernel ksmbd path handling POSIX ACLs. The root cause is a check failure in ACE validation: set_ntacl_dacl() validates sid.num_subauth but does not ensure the declared ACE size can contain all sub-authorities, allowing an undersized ACE to be copied and l...

EUVD-2026-55262

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...

CVE-2026-59088 Gimp: gimp: denial of service via signed integer overflow in fli file processing

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...