CVE-2026-68242

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix NULL deref on schedengine alloc failure Avoid using intelcontextput before intelcontextinit in execlistscreatevirtual as the krefput inside would lead to NULL deref on the IOCTL path when schedengine allocation...

CVE-2026-68244

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings on proto context error After a successful BALANCE/PARALLELSUBMIT extension on context creation, error during processing of next user extension leaks the siblings array. Fix that. Discovered usin...

AZL-94938 CVE-2026-68241 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

AZL-95135 CVE-2026-68233 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68233

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

DEBIAN-CVE-2026-68236

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

CVE-2026-68232

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: Fix MM reference leak in drmgpusvmrangeevict If kvmallocarray fails in drmgpusvmrangeevict, the MM reference acquired earlier is not released, resulting in a reference leak. Fix this by dropping the MM reference on th...

CVE-2026-68236

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

CVE-2026-68255

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68233

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Shut down BO cache timer before teardown The BO cache timer callback schedules timework, and timework can rearm the timer through vc4bocachefreeold. vc4bocachedestroy deletes the timer and then cancels the work, which do...

CVE-2026-68279

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68305

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

UBUNTU-CVE-2026-68248

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in activeinstance Avoid returning &node-base when node is NULL due to OOM during GFPATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry picked...

CVE-2026-68384

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

CVE-2026-68240

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

UBUNTU-CVE-2026-68246

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd...

UBUNTU-CVE-2026-68265

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

UBUNTU-CVE-2026-68235

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs e.g. Bonaire, the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second...