CVE-2026-68202

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

CVE-2026-68233

A flaw was found in the drm/vc4 component of the Linux kernel. A logic error in the BO cache timer shutdown process allows the timer to be rearmed even after it has been destroyed. This can lead to work being queued again after teardown, potentially causing system instability or a denial of servi...

CVE-2026-68198

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the aggrresetstate function. This occurs because a non-synchronous timer deletion allows a timer callback aggrtimeout to access memory that has already been freed, creating a race condition. A...

CVE-2026-68200

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. A lack of serialization in the userspace-driven timer utimer TRIGGER ioctl allows two threads to concurrently call sndtimerinterrupt. This race condition can lead to a use-after-free vulnerability, wher...

CVE-2026-68090

A flaw was found in the debugobjects component of the Linux kernel. A race condition can occur when an out-of-memory OOM situation happens concurrently with certain debug object operations. This can lead to a dysfunctional timer and a kernel warning, potentially causing system instability or a...

CVE-2026-68201

A flaw was found in the ALSA Advanced Linux Sound Architecture timer component of the Linux kernel. When a master timer instance is closed, it does not properly ensure that all associated slave timer callbacks have finished executing before detaching them. This oversight can lead to a...

CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-68198

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like...

Linux Distros Unpatched Vulnerability : CVE-2026-68201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before...

Linux Distros Unpatched Vulnerability : CVE-2026-68200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no...

CVE-2026-68129

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

CVE-2026-68233

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68202

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

CVE-2026-68200

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68198

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like...

CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

UBUNTU-CVE-2026-68233

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

UBUNTU-CVE-2026-68198

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggrresetstate The aggrresetstate function uses timerdelete non-synchronous for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like...

UBUNTU-CVE-2026-68200

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

UBUNTU-CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...