CVE-2026-68102

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to always return false, so iounmapaperbasekaddr never runs on normal driv...

CVE-2026-68101 drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpuhmminvalidategfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo-vmbo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can alwa...

CVE-2026-68101

Removed by vendor...

CVE-2026-68099

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

CVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68096

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in auditdupeexe A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved e.g., via dorenameat2, the VFS layer locks the parent directory...

CVE-2026-68095

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

CVE-2026-68094

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

CVE-2026-68092

In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksour...

CVE-2026-68091

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...

CVE-2026-68090

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...

CVE-2026-68089

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If ppos is non-zero then simplewritetobuffer will not initialize the start of buf. Non zero values for ppos aren't going to work anyway. Test for them at the start of the function and...

CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

CVE-2026-68087

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

CVE-2026-68086

In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing There is no upstream commit, as this code was removed by upstream commit 044925f9b565 "mm: fs: remove filemapnrthps functions and their users" As-is, khugepaged and...

CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...