CVE-2026-68175

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

UBUNTU-CVE-2026-68370

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummyhcd: prevent fiforeq reuse during giveback dummyhcd embeds a single shared usbrequest dum-fiforeq that the "emulated single-request FIFO" fast-path in dummyqueue reuses for small IN transfers: it copies the...

UBUNTU-CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-68377

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68351

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback logs the mismatch and calls carl9170restart but then falls through to...

CVE-2026-68218

In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove callback to free its resources, thus fixing memory leak...

CVE-2026-68370

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: dummyhcd: prevent fiforeq reuse during giveback dummyhcd embeds a single shared usbrequest dum-fiforeq that the "emulated single-request FIFO" fast-path in dummyqueue reuses for small IN transfers: it copies the...

CVE-2026-68132

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

EUVD-2026-55596

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

EUVD-2026-55563

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68377

CVE-2026-68377 affects the Linux kernel net/sched component, specifically act_tunnel_key. The issue is a race leading to use-after-free during tunnel_key_release_params() where metadata_dst is released synchronously via dst_release() while the old params are freed with kfree_rcu(), allowing a con...

CVE-2026-68377 net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68375 bnxt_en: Handle partially initialized auxiliary devices

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68375

The CVE affects bnxt_en in the Linux kernel. bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. If allocation fails after auxiliary_device_init(), the release path can dereference or clear partially initialized state. The fix is...

CVE-2026-68370

CVE-2026-68370 affects the Linux kernel USB gadget dummy_hcd path. A race condition reuses a shared usb_request (fifo_req) before its completion callback finishes, allowing overwriting of the callback pointer and causing a general protection/page fault in dummy_timer. The mitigation adds a fifo_r...

EUVD-2026-55466

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...

CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68363

The CVE affects the Linux kernel ath9k wireless driver (ath9k_htc) in the hif_usb path. The vulnerability arises when an asynchronous firmware load is re-armed via request_firmware_nowait(), which passes hif_dev as the completion context and later dereferences hif_dev in a post-request dev_info()...