UBUNTU-CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

UBUNTU-CVE-2026-68318

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

UBUNTU-CVE-2026-68218

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove callback to free its resources, thus fixing memory leak...

UBUNTU-CVE-2026-68414

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

UBUNTU-CVE-2026-68319

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...

CVE-2026-68085

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

CVE-2026-68414 wifi: cfg80211: cancel sched scan results work on unregister

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

EUVD-2026-55589

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68382

CVE-2026-68382 relates to the Linux kernel drm/xe/guc driver. The issue is a race during asynchronous destruction of GuC execution queues: if the final device reference is released while destruction is still pending, DRM cleanup may drain the same workqueue and deadlock. Mitigation implemented in...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68363

The CVE affects the Linux kernel ath9k wireless driver (ath9k_htc) in the hif_usb path. The vulnerability arises when an asynchronous firmware load is re-armed via request_firmware_nowait(), which passes hif_dev as the completion context and later dereferences hif_dev in a post-request dev_info()...

EUVD-2026-55420

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...

CVE-2026-68319

The CVE-2026-68319 entry concerns Linux kernel code where a deadlock could occur between the PCI reset thread and removal path. The root cause was that pci_reset_function() acquires device_lock, and pdsc_remove() is invoked with that lock held; if the reset thread is active, destroy_workqueue() b...

CVE-2026-68319 pds_core: fix deadlock between reset thread and remove

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...

CVE-2026-68319 pds_core: fix deadlock between reset thread and remove

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix deadlock between reset thread and remove pciresetfunction acquires devicelock before performing the reset. pdscremove is called by the PCI core with devicelock already held. If pdscpciresetthread is running when...

CVE-2026-68318 pds_core: fix use-after-free on workqueue during remove

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

CVE-2026-68318 pds_core: fix use-after-free on workqueue during remove

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix use-after-free on workqueue during remove In pdscremove, the workqueue is destroyed before pdscteardown is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdscteardown -...

CVE-2026-68318

The CVE-2026-68318 entry concerns a Linux kernel use-after-free in pds_core during remove, caused by destroying the workqueue before pdsc_teardown() completes. The issue allows queued work on a destroyed workqueue via two paths: (1) a timeout in pdsc_teardown() -> pdsc_devcmd_reset() causes he...