CVE-2026-68249

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

CVE-2026-68231

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

CVE-2026-68196

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: validate assoc response length before subtracting header wilcparseassocrespinfo computes the trailing IE length as ieslen = bufferlen - sizeofres; without first checking that bufferlen is at least sizeofstruct...

CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

CVE-2026-68185

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Move jumplabelinit before parseearlyparam When enabling both CONFIGMEMALLOCPROFILING=y and CONFIGMEMALLOCPROFILINGENABLEDBYDEFAULT=y, then diabling memory profiling by adding the boot parameter 'sysctl.vm.memprofiling=...

EUVD-2026-55556

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68168

In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...

CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68148

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...

EUVD-2026-55527

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68144 phonet: pep: fix use-after-free in pep_get_sb()

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68135 net: hip04: fix RX buffer leak on build_skb failure

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...

EUVD-2026-55508

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

CVE-2026-68121

Summary of CVE-2026-68121 (Linux kernel, PPPoE): A vulnerability arises when device header callbacks reallocate the skb head after PPPoE header is referenced, causing a stale pointer to the PPPoE header used by pppoe_sendmsg(). This can occur if a send is blocked in copy_from_user() while a non-E...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

...

UBUNTU-CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64577 gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...