DEBIAN-CVE-2026-68266

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

DEBIAN-CVE-2026-68255

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

DEBIAN-CVE-2026-68256

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

DEBIAN-CVE-2026-68249

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

DEBIAN-CVE-2026-68251

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

DEBIAN-CVE-2026-68252

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

DEBIAN-CVE-2026-68238

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Release VFCT ACPI table reference amdgpuacpivfctbios fetches the VFCT table with acpigettable but never releases it. acpigettable takes a reference on the table incrementing its validationcount and mapping it on the 0...

DEBIAN-CVE-2026-68240

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

DEBIAN-CVE-2026-68234

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo-pin leaking in amdgpubocreatereserved amdgpubocreatereserved only allocates a new BO when boptr struct amdgpubo boptr as input parameter is NULL, it simply skips creation when boptr is non-NULL. But it...

DEBIAN-CVE-2026-68233

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

DEBIAN-CVE-2026-68222

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

DEBIAN-CVE-2026-68215

In the Linux kernel, the following vulnerability has been resolved: media: radio-si476x: Unregister v4l2device on probe failure si476xradioprobe registers radio-v4l2dev before allocating the V4L2 controls and before registering the video device. If any of those later steps fails, probe returns...

DEBIAN-CVE-2026-68216

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

DEBIAN-CVE-2026-68210

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmigraphinit registers the async notifier before dcmiprobe toggles the reset line. If resetcontrolassert or resetcontroldeassert fails afterwards, probe returns through...

DEBIAN-CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

DEBIAN-CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

DEBIAN-CVE-2026-68188

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

DEBIAN-CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

DEBIAN-CVE-2026-68181

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

DEBIAN-CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...