CVE-2026-68148 fscrypt: Add missing superblock check in find_or_insert_direct_key()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...

CVE-2026-68148

The CVE relates to the Linux kernel fscrypt component. A missing superblock check in fscrypt_find_or_insert_direct_key() allowed inode keys to be shared across different super_blocks, risking use-after-free of a fscrypt_direct_key and potentially enabling denial of service, information disclosure...

CVE-2026-68147 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68147

Summary: CVE-2026-68147 affects the Linux kernel fscrypt subsystem. When a blk_crypto_key is evicted, the code previously allocated a list of block devices on the heap; allocation failures could lead to premature key free and a use-after-free. The fix switches to an on-stack array to enumerate bl...

CVE-2026-68147 fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

EUVD-2026-55532

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68147

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68146

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

CVE-2026-68145

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

EUVD-2026-55527

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68144 phonet: pep: fix use-after-free in pep_get_sb()

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68144

The CVE-2026-68144 issue is in the Linux kernel Phonet subsystem (pep_get_sb). The root cause is use-after-free caused when pep_get_sb() doesn’t account for skb data relocation by pskb_may_pull(), leading to a stale pointer dereference. Reproductions via KASAN show slab-use-after-free in pep_get_...

CVE-2026-68144 phonet: pep: fix use-after-free in pep_get_sb()

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68142

In the Linux kernel, the following vulnerability has been resolved: geneve: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns geneve-net. They differ once the device is created in or moved to a netns...

CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68140 net/iucv: fix use-after-free of a severed iucv_path

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

EUVD-2026-55522

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-68140

The CVE affects the Linux kernel net/iucv subsystem. A use-after-free occurs when a peer severs a connection and not-yet-received notifications still reference a freed iucv_path; on processing, a stale path is handed to message_receive(), causing memory corruption. The fix drops queued notificati...

CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...