CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

UBUNTU-CVE-2026-68181

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

UBUNTU-CVE-2026-68203

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

UBUNTU-CVE-2026-68170

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

UBUNTU-CVE-2026-68220

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Add missing v4l2subdevcleanup in crossbar and pipe Both mxcisicrossbarinit and mxcisipipeinit call v4l2subdevinitfinalize which allocates the subdev active state, but neither mxcisicrossbarcleanup nor...

CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68102

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to always return false, so iounmapaperbasekaddr never runs on normal driv...

EUVD-2026-55601

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

EUVD-2026-55595

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68403

The CVE concerns the Linux kernel driver brcmfmac SDIO path. In brcmf_sdio_probe(), the newly allocated bus is stored in sdiodev->bus before the ordered workqueue is initialized. If allocation fails, the path can reach brcmf_sdio_remove(), which unconditionally cancels bus->datawork. The bu...

EUVD-2026-55589

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68389

The CVE-2026-68389 entry concerns a Linux kernel Bluetooth HCI driver (Qualcomm/Atheros QCA) issue. A zero/invalid memdump size in qca_controller_memdump() could leave qca->qca_memdump and collection flags in an inconsistent state, causing a later memdump work item to operate on freed memory a...

CVE-2026-68389 Bluetooth: hci_qca: Clear memdump state on invalid dump size

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68380

CVE-2026-68380 affects the Linux kernel AMD XDNA accelerator driver (accel/amdxdna). The vulnerability arises when amdxdna_cmd_submit() stores current->mm in job->mm without a structural reference, and aie2_sched_job_run() later reads job->mm from the DRM scheduler worker thread. This cr...

CVE-2026-68375 bnxt_en: Handle partially initialized auxiliary devices

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

EUVD-2026-55561

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

EUVD-2026-55428

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68327

CVE-2026-68327 (wanxl Linux kernel driver): The wanxl PCIe driver resets hardware only after the PLX BAR is mapped. A failure path during probe can call wanxl_reset() while card->plx is NULL, dereferencing MMIO and risking a NULL pointer. The root cause is that wanxl_pci_init_one() stores the ...

CVE-2026-68323

A race condition was found in the Linux kernel TIPC UDP bearer replication list handling (tipc_udp_rcast_add and cleanup_bearer). Without proper serialization, updates to ub->rcast.list can corrupt the list, potentially triggering a kernel bug and denial of service. The fix adds a spinlock to ...