8651 matches found
UBUNTU-CVE-2026-68375
In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...
UBUNTU-CVE-2026-68327
In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...
CVE-2026-68328
In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...
CVE-2026-68247
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...
CVE-2026-68354
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...
UBUNTU-CVE-2026-68253
In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...
UBUNTU-CVE-2026-68135
In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...
UBUNTU-CVE-2026-68091
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...
CVE-2026-68091
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...
CVE-2026-68354 firewire: net: Fix fragmented datagram reassembly
In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...
CVE-2026-68328 nfp: Check resource mutex allocation
In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...
CVE-2026-68328
The CVE relates to the Linux kernel nfp subsystem. Specifically, nfp_cpp_resource_find() allocates a CPP mutex handle for a matching resource-table entry, and nfp_resource_try_acquire() passes that handle to nfp_cpp_mutex_trylock(). If nfp_cpp_mutex_alloc() fails and returns NULL, the resource lo...
CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping
In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...
EUVD-2026-55415
In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...
CVE-2026-68269 drm/i915/gem: Add missing nospec on parallel submit slot
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...
EUVD-2026-55354
In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...
EUVD-2026-55344
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...
CVE-2026-68242 drm/i915/gt: Fix NULL deref on sched_engine alloc failure
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...
EUVD-2026-55293
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...
CVE-2026-68185
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Move jumplabelinit before parseearlyparam When enabling both CONFIGMEMALLOCPROFILING=y and CONFIGMEMALLOCPROFILINGENABLEDBYDEFAULT=y, then diabling memory profiling by adding the boot parameter 'sysctl.vm.memprofiling=...