CVE-2026-68121

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-68127

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

UBUNTU-CVE-2026-68100

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

CVE-2026-68425 IB/mad: Drop unmatched RMPP responses before reassembly

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, aft...

CVE-2026-68425

CVE-2026-68425 concerns the Linux kernel InfiniBand MAD path (IB/mad). The vulnerability arises when kernel-handled RMPP receive processing begins reassembly for DATA responses before matching the response to an outstanding send, enabling a reordered burst to reach receive-side insertion without ...

EUVD-2026-55584

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

CVE-2026-68379

The CVE-2026-68379 item covers a Linux kernel TCP TIME_WAIT reference leak when PSP policy fails, in both IPv4 and IPv6 receive paths. This can cause memory leakage of tcp_tw_bucket structures and potential DoS via resource exhaustion. The documented fix releases the TIME_WAIT socket reference an...

EUVD-2026-55565

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket reference and jump to discardit upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcptwbucket...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

EUVD-2026-55561

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68336 bonding: fix devconf_all NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...

CVE-2026-68335 rds: drop incoming messages that cross network namespace boundaries

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

EUVD-2026-55424

In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipcudprcastadd and cleanupbearer both update ub-rcast.list with listaddrcu / listdelrcu, but nothing serializes them. The add runs from the encap receive softirq via...

CVE-2026-68323

A race condition was found in the Linux kernel TIPC UDP bearer replication list handling (tipc_udp_rcast_add and cleanup_bearer). Without proper serialization, updates to ub->rcast.list can corrupt the list, potentially triggering a kernel bug and denial of service. The fix adds a spinlock to ...

CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

EUVD-2026-55402

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

CVE-2026-68300

Summary: CVE-2026-68300 in the Linux kernel concerns SCTP authentication. The function sctp_auth_chunk_verify() incorrectly returns true when auth_chunk is NULL, allowing authentication to be bypassed under certain conditions (e.g., skb_clone() failure in BH path or absence of an AUTH before COOK...

CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

EUVD-2026-55378

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68244

The CVE relates to the Linux kernel DRM/I915 GEM component. After a BALANCE/PARALLEL_SUBMIT extension during context creation, an error in processing the next user extension could leak the siblings[] array; this has been resolved. The fix is cherry-picked from commit aa65e0a4b51b3b54b53e4142aaa2d...