UBUNTU-CVE-2026-68208

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devmkzalloc in vipprobeslice In vipprobeslice, the error check for devmkzalloc incorrectly uses PTRERRORZERO which returns 0 for NULL pointer. Return -ENOMEM for devmkzalloc failure...

UBUNTU-CVE-2026-68412

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

UBUNTU-CVE-2026-68298

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...

UBUNTU-CVE-2026-68268

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

CVE-2026-68418 RDMA/irdma: Prevent user-triggered null deref on QP create

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

CVE-2026-68413 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

EUVD-2026-55598

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

EUVD-2026-55582

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

CVE-2026-68362 wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL pointer dereference in ath11khalsrngaccessbegin In ATH11KQMIEVENTFWREADY, ATH11KFLAGREGISTERED is set unconditionally even when ath11kcoreqmifirmwareready fails. This leaves the driver in an inconsistent...

CVE-2026-68313

The CVE-2026-68313 entry concerns a Linux kernel tipc issue where a negative return from the cmd->dumpit callback could cause an infinite loop in the __tipc_nl_compat_dumpit code path, because the while (len) loop never terminates and the genl_mutex is not released. The vulnerability is resolv...

EUVD-2026-55414

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

EUVD-2026-55372

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68261

Technical details about CVE-2026-68261 are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-68248

CVE-2026-68248 affects the Linux kernel DRM/i915 driver. The vulnerability arises in the active_instance error path where a NULL node could be used, due to OOM during GFP_ATOMIC allocation, leading to unsafe return of a pointer. The fix modifies the path to return NULL on error instead of derefer...

CVE-2026-68240 drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

CVE-2026-68226

The CVE affects the Linux kernel component media: cx23885. A vulnerability was resolved by adding a check for the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, the code now releases the allocated PCI memory region, decrements the device count, and returns -E...

EUVD-2026-55327

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pciioremapbar in cx23885devsetup. If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, an...