EUVD-2026-55415

In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...

CVE-2026-68314

Summary (CVE-2026-68314): The Linux kernel MCTP I3C subsystem contains a defect in mctp_i3c_mod_init(): it registers the I3C bus notifier and then iterates existing buses before the I3C device driver is registered. If i3c_driver_register() fails, the error is returned without cleaning up the noti...

CVE-2026-68314 net: mctp i3c: clean up notifier and buses if driver register fails

In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...

CVE-2026-68305 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

CVE-2026-68301 net: hsr: fix memory leak on slave unregistration by removing synced VLANs

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

CVE-2026-68301

The CVE-2026-68301 entry details a Linux kernel net: hsr memory leak where, on slave unregistration, VLAN IDs synced to the slave (including VID 0) are not deleted, leaving vlan_info/vlan_vid_info refs and causing a leak when the slave is destroyed. The fix adds vlan_vids_del_by_dev(port->dev,...

CVE-2026-68298 drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271

CVE-2026-68271 involves the DRM/Nouveau component of the Linux kernel. The issue stems from incorrect error cleanup order in ucopy paths (nouveau_uvmm_vm_bind_ucopy and nouveau_exec_ucopy): cleanup labels were placed in allocation order instead of reverse allocation order. This could cause derefe...

EUVD-2026-55372

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

EUVD-2026-55327

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pciioremapbar in cx23885devsetup. If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, an...

CVE-2026-68226

The CVE affects the Linux kernel component media: cx23885. A vulnerability was resolved by adding a check for the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, the code now releases the allocated PCI memory region, decrements the device count, and returns -E...

EUVD-2026-55323

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

CVE-2026-68222

CVE-2026-68222 describes a Linux kernel asyncio path issue in the media driver msi2500 where start_streaming() errors could leak queued buffers if not returned via vb2_buffer_done(). The kernel fix consolidates five error paths into a small goto chain, drains the queued-buffer list on failure, an...

CVE-2026-68220

In the Linux kernel vulnerability CVE-2026-68220, the media: nxp: imx8-isi driver (mxc_isi_crossbar_init and mxc_isi_pipe_init) allocates v4l2_subdev state via v4l2_subdev_init_finalize but fails to free it during cleanup, causing a memory leak on every rmmod. The remediation is to add the missin...

CVE-2026-68220 media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Add missing v4l2subdevcleanup in crossbar and pipe Both mxcisicrossbarinit and mxcisipipeinit call v4l2subdevinitfinalize which allocates the subdev active state, but neither mxcisicrossbarcleanup nor...

EUVD-2026-55321

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Add missing v4l2subdevcleanup in crossbar and pipe Both mxcisicrossbarinit and mxcisipipeinit call v4l2subdevinitfinalize which allocates the subdev active state, but neither mxcisicrossbarcleanup nor...

CVE-2026-68216 media: pwc: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

EUVD-2026-55317

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...