CVE-2026-68299 vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

EUVD-2026-55400

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

EUVD-2026-55399

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...

CVE-2026-68292 ice: prevent tstamp ring allocation for non-PF VSI types

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

EUVD-2026-55391

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

CVE-2026-68289

CVE-2026-68289 relates to Linux kernel TIPC tipc_recvmsg() and tipc_recvstream() where an integer overflow occurs due to min_t(int, dlen - offset, buflen) when buflen exceeds INT_MAX via io_uring buffers. The fix changes min_t(int, ...) to min_t(size_t, ...) in both functions, ensuring the comput...

CVE-2026-68284

CVE-2026-68284 affects the Linux kernel BPF/sockmap path. The bug is a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket: msg_tx is compared to psock->cork while cork may have been freed, leading to freeing a stale cork. A fix ensures tmp cork is checked directly, pr...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

CVE-2026-68280

The CVE affects the Linux kernel DRM/Bridge code for cdns-dsi. The root cause is using the deprecated UNIVERSAL_DEV_PM_OPS() macro, which handles both runtime PM and system sleep, causing DSI clocks to be disabled twice (runtime suspend and system suspend). This can trigger a WARN from the clock ...

CVE-2026-68279

The CVE-2026-68279 issue affects the Linux kernel DRM/DP MST path. Specifically, drm_dp_sideband_parse_remote_dpcd_read() and drm_dp_sideband_parse_remote_i2c_read_ack() read num_bytes from raw->msg and then memcpy(bytes, &raw->msg[idx], num_bytes) without validating that idx + num_bytes cu...

CVE-2026-68277

The CVE-2026-68277 entry concerns Linux kernel DRM/DP/MST sideband reply parsers where three 16-bit reads check bounds after reading, risking out-of-bounds access (idx == curlen). A fix was applied: pre-check using a single combined condition (idx + 2 > curlen) before each 2-byte read. Affecte...

EUVD-2026-55376

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68274 drm/xe/guc: Fix buffer overflow in steered register list allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

CVE-2026-68270

The CVE-2026-68270 entry concerns the Linux kernel component drm/sysfb where the visible size of the system framebuffer could be truncated due to 32-bit arithmetic overflow when height and stride are large. The root cause is arithmetic overflow in calculating the visible size; the fix replaces th...

CVE-2026-68267 drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RINGFORCETONONPRIVDENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RINGFORCETONONPRIVDENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default...

EUVD-2026-55367

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

CVE-2026-68265

CVE-2026-68265 affects the Linux kernel, specifically the drm/xe/vm path. The issue arises when prefetching a BO VMA in the region DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC, where the code uses the value as an index into region_to_mem_type[], causing an out-of-bounds access (value is -1). The remediatio...

EUVD-2026-55356

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

CVE-2026-68250

In the Linux kernel component drm/amdgpu/sdma5.2, CVE-2026-68250 addresses a path where a BUG_ON() could crash the kernel. The vulnerability is resolved by replacing BUG_ON() with WARN_ON(), avoiding a kernel crash in these cases. The fix was cherry-picked from commit ae658afc7f47f6147371ec42cc6b...

EUVD-2026-55350

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d...