CVE-2026-68250

In the Linux kernel component drm/amdgpu/sdma5.2, CVE-2026-68250 addresses a path where a BUG_ON() could crash the kernel. The vulnerability is resolved by replacing BUG_ON() with WARN_ON(), avoiding a kernel crash in these cases. The fix was cherry-picked from commit ae658afc7f47f6147371ec42cc6b...

CVE-2026-68249 drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

EUVD-2026-55347

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68204 media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68203 media: vivid: fix cleanup bugs in vivid_init()

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

CVE-2026-68202

CVE-2026-68202 affects the Linux kernel’s ALSA sequencer. A race in queue timer cleanup allows an unprivileged local user with access to /dev/snd/seq to re-open a timer that has just been closed, leading to a use-after-free of the timer/queue object and a potential crash or, in theory, arbitrary ...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68165 mm/damon/core: validate ranges in damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68144

The CVE-2026-68144 issue is in the Linux kernel Phonet subsystem (pep_get_sb). The root cause is use-after-free caused when pep_get_sb() doesn’t account for skb data relocation by pskb_may_pull(), leading to a stale pointer dereference. Reproductions via KASAN show slab-use-after-free in pep_get_...

CVE-2026-68115

The CVE-2026-68115 entry relates to the Linux kernel DRM/AMDGPU gfx10 driver. The issue was that BUG_ON() caused a kernel crash and has been replaced with WARN_ON(), so the code no longer forces a crash in these cases. This is a code fix (cherry-picked from commit ac6f00beb658239bced4aaed9efbb04a...

EUVD-2026-55496

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

CVE-2026-68114 drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23...

EUVD-2026-55492

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

CVE-2026-68109

CVE-2026-68109 : In the Linux kernel’s drm/amdgpu/sdma7.1 path, the vulnerability was resolved by replacing a failing assertion: replace BUG_ON() with WARN_ON() so the kernel no longer crashes in these cases. The commit cherry-picks the fix (c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5). Affected com...

EUVD-2026-55490

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

CVE-2026-68087 HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-6.0.2-2.2.hum1 aarch64, x8664 podman-docker-6.0.2-2.2.hum1 noarch podman-machine-6.0.2-2.2.hum1 aarch64, x8664 podman-remote-6.0.2-2.2.hum1 aarch64, x8664 podmansh-6.0.2-2.2.hum1...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: fuse-overlayfs: fuse-overlayfs-1.17-1.hum1 aarch64, x8664 fuse-overlayfs-1.17-1.hum1.src src...

PYSEC-2026-3646 Open WebUI: Users denied the image-generation permission can still generate images via chat completions

Summary An authenticated user whose features.imagegeneration permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permission...