AZL-94842 CVE-2026-68253 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

DEBIAN-CVE-2026-68253

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

DEBIAN-CVE-2026-68247

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68249

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...

CVE-2026-68225

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

CVE-2026-68226

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pciioremapbar in cx23885devsetup. If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, an...

CVE-2026-68204

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

CVE-2026-68176

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

DEBIAN-CVE-2026-68165

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate ranges in damonsetregions DAMON core logic assumes zero length regions don't exist. However, a few DAMON API callers including DAMONSYSFS, DAMONRECLAIM and DAMONLRUSORT allow users to set empty monitoring...

CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68258

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

UBUNTU-CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

CVE-2026-68400

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

UBUNTU-CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

UBUNTU-CVE-2026-68247

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68412

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68247

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...