CVE-2026-68212 media: saa7134: Fix a possible memory leak in saa7134_video_init1

In the Linux kernel, the following vulnerability has been resolved: media: saa7134: Fix a possible memory leak in saa7134videoinit1 In saa7134videoinit1, the return value of the first saa7134pgtablealloc is not checked. If it fails, the function continues as if successful, leaving the driver with...

CVE-2026-68207 media: ti: vpe: unwind v4l2 device registration on probe error

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpetop resource is missing, vpeprobe returns -ENODEV after v4l2deviceregister has succeeded. Probe failures do not call the driver's remove callback, so the v4...

EUVD-2026-55308

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: unwind v4l2 device registration on probe error If the vpetop resource is missing, vpeprobe returns -ENODEV after v4l2deviceregister has succeeded. Probe failures do not call the driver's remove callback, so the v4...

CVE-2026-68207

The CVE concerns the Linux kernel TI VPE media driver: if vpe_top is missing, vpe_probe() returns -ENODEV after v4l2_device_register(), and probe failures do not call the driver’s remove callback, leaving the v4l2 device registered. The fix routes the failure through the existing v4l2_device_unre...

CVE-2026-68203

CVE-2026-68203—Linux kernel media: vivid driver : The issue is a cleanup bug in vivid_init() that can cause a reference leak when platform_device_register() fails. The embedded device in vivid_pdev is initialized via device_initialize(), but on failure the path jumps to free_output_strings withou...

CVE-2026-68203 media: vivid: fix cleanup bugs in vivid_init()

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

EUVD-2026-55304

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vividinit When platformdeviceregister fails in vividinit, the embedded struct device in vividpdev has already been initialized by deviceinitialize, but the failure path jumps to freeoutputstrings...

EUVD-2026-55295

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA tx queues with...

CVE-2026-68194

The CVE-2026-68194 issue affects Linux kernel wifi driver stack mt76/mt7921: TXRX_NOTIFY is an mmio-only event but was dispatched on non-mmio buses (USB/SDIO) via mt7921_rx_check()/mt7921_queue_rx_skb(), causing a NULL pointer dereference in mt7921_mac_tx_free() when mt76_queue_tx_cleanup() calls...

EUVD-2026-55292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189

CVE-2026-68189 affects the Linux kernel Bluetooth hci_sync component. A race between asynchronous command sync work and UUID list updates can cause a use-after-free in eir_create due to non-serialized access to hdev->uuids. The fix/mitigation is to hold hdev->lock while generating and commi...

CVE-2026-68182 comedi: comedi_parport: deal with premature interrupt

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

EUVD-2026-55282

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181

In the Linux kernel, CVE-2026-68181 affects the mei bus cleanup path. The vulnerability arises in mei_cl_bus_dev_release() where mei_cl_flush_queues() runs without holding a lock, and subsequent access to bus->file_list after mei_dev_bus_put(bus) can lead to a use-after-free if it was the last...

CVE-2026-68180

CVE-2026-68180: In the Linux kernel intel_th MSC output path, a reference leak occurred. intel_th_output_open() selects the output device via bus_find_device_by_devt(), which returns a device reference that must be dropped. The release path for MSC outputs, intel_th_msc_release(), only removed th...

CVE-2026-68180 intel_th: fix MSC output device reference leak

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...

EUVD-2026-55281

In the Linux kernel, the following vulnerability has been resolved: intelth: fix MSC output device reference leak intelthoutputopen looks up the output device with busfinddevicebydevt, which returns the device with a reference that must be dropped after use. commit 95fc36a234da "intelth: fix devi...