CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68149

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

CVE-2026-68149 fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

EUVD-2026-55530

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

CVE-2026-68143 net: slip: serialize receive against buffer reallocation

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68142

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68139 net/mlx5e: Use sender devcom for MPV master-up

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68138 net/sched: serialize qdisc_rtab_list against concurrent get/put

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

CVE-2026-68122 ovpn: fix peer refcount leak in TCP error paths

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68109

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

CVE-2026-68108

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

CVE-2026-68107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68103 drm/amdgpu: reject mapping a reserved doorbell to a new queue

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

EUVD-2026-55476

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68095 fuse-uring: fix race between registration and connection abortion

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68095 fuse-uring: fix race between registration and connection abortion

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...