CVE-2026-68243

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68238

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Release VFCT ACPI table reference amdgpuacpivfctbios fetches the VFCT table with acpigettable but never releases it. acpigettable takes a reference on the table incrementing its validationcount and mapping it on the 0...

CVE-2026-68237

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

CVE-2026-68234

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

CVE-2026-68231

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

CVE-2026-68230

In the Linux kernel, the following vulnerability has been resolved: media: amlogic-c3: Add validations for ae and awb config Avoid invalid memory access if the zonesnum is bigger than zoneweight. This patch fixes the following smatch errors: drivers/media/platform/amlogic/c3/isp/c3-isp-params.c:1...

CVE-2026-68229

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: skip invalid H.264 reference list entries Cedrus consumes H.264 refpiclist0/refpiclist1 entries from the stateless slice control and later uses their indices to look up decode-dpb in cedruswritereflist. Rejecting...

CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

CVE-2026-68225

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

CVE-2026-68224

In the Linux kernel, the following vulnerability has been resolved: media: mali-c55: Fix possible ERRPTR in enablestreams The mediapadremotepadunique function returns either a valid pointer or an ERRPTR on failure -ENOTUNIQ if multiple links are enabled, -ENOLINK if no connected pad is found. The...

CVE-2026-68223

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

CVE-2026-68220

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Add missing v4l2subdevcleanup in crossbar and pipe Both mxcisicrossbarinit and mxcisipipeinit call v4l2subdevinitfinalize which allocates the subdev active state, but neither mxcisicrossbarcleanup nor...

CVE-2026-68219

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respo...

CVE-2026-68218

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove callback to free its resources, thus fixing memory leak...

CVE-2026-68217

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Drain fillbuf on startstreaming failure pwcisocinit submits its isochronous URBs with usbsubmiturb.., GFPKERNEL in a loop. After the first URB is submitted, its completion handler pwcisochandler can run on another CPU...

CVE-2026-68214

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832remove canceldelayedworksync is called before i2cmuxdeladapters in rtl2832remove. While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the time...

CVE-2026-68213

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

CVE-2026-68210

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmigraphinit registers the async notifier before dcmiprobe toggles the reset line. If resetcontrolassert or resetcontroldeassert fails afterwards, probe returns through...