CVE-2026-68259

CVE-2026-68259 affects the Linux kernel's DRM/amdkfd path, specifically allocate_event_notification_slot. The vulnerability arises from not validating the upper bound of user-supplied event IDs used by CRIU; valid IDs are 0 to KFD_SIGNAL_EVENT_LIMIT. The fix adds bounds checks, ensuring the upper...

CVE-2026-68258 drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on CRIU restore queue type and mqd size We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFDQUEUETYPEMAX and ensure the...

EUVD-2026-55354

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

CVE-2026-68253

CVE-2026-68253 affects the Linux kernel’s drm/i915/hdcp component. The issue arises because the check for streams[] bounds is performed after a potential buffer overflow has already occurred during a write, allowing memory corruption. The fix moves the overflow bound check before the write, preve...

CVE-2026-68253 drm/i915/hdcp: check streams[] bounds before overflow

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

EUVD-2026-55353

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

EUVD-2026-55348

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68247 drm/i915/bios: range check LFP Data Block panel_type2

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68247 drm/i915/bios: range check LFP Data Block panel_type2

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: range check LFP Data Block paneltype2 While the paneltype from LFP Data Block is range checked, paneltype2 is not. Add a few helpers for range checking, and use them to not only check paneltype2, but also improve...

CVE-2026-68226 media: cx23885: add ioremap return check and cleanup

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pciioremapbar in cx23885devsetup. If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, an...

CVE-2026-68225

The CVE-2026-68225 entry covers a Linux kernel issue in the media: i2c/alvium driver where alvium_ctrl_init creates several controls and uses the returned pointer without validating it, enabling potential write access to a NULL pointer for multiple controls. The fix reworked alvium_ctrl_init to c...

CVE-2026-68208 media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devmkzalloc in vipprobeslice In vipprobeslice, the error check for devmkzalloc incorrectly uses PTRERRORZERO which returns 0 for NULL pointer. Return -ENOMEM for devmkzalloc failure...

CVE-2026-68204

CVE-2026-68204 affects the Linux kernel media subsystem (vivid driver). The vulnerability arises because vivid_update_format_cap/out() may be invoked to change formats while the capture/output queue is still busy, due to missing vb2_is_busy() checks when toggling CROP/COMPOSE/SCALE capabilities. ...

CVE-2026-68167 btrfs: do not try compression for data reloc inodes

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

EUVD-2026-55544

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68158

CVE-2026-68158 (Linux kernel libceph) : A vulnerability in decoding CEPH_MSG_OSD_MAP can overflow when computing the length of the new_state portion, causing an overflowed bounds check and potentially out-of-bounds memory reads during osdmap decoding. The issue arises from a multiplication that m...

EUVD-2026-55525

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

CVE-2026-72688

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...