EUVD-2026-55577

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

CVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

CVE-2026-68389 Bluetooth: hci_qca: Clear memdump state on invalid dump size

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68388

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3simplefallocaterange can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled,...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68385

In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csumpartial without vector facility Currently csumpartial calls csumcopy with copy=false and dst=NULL. On machines without the vector facility, csumcopy falls back to cksmdst, ..., causing the checksum to be...

CVE-2026-68384

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...

CVE-2026-68383 drm/xe/guc: Keep scheduler timeline name alive

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q-name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xegucexecqueue so ...

CVE-2026-68383

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q-name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xegucexecqueue so ...

CVE-2026-68382

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68381

CVE-2026-68381 affects the Linux kernel ksmbd (SMB server) and describes a race between connection teardown and asynchronous oplock/lease break notifications. The vulnerability occurs when a ksmbd_conn pointer is stored in an async work item and queued on ksmbd-io; the work only increments conn-&...

CVE-2026-68381 ksmbd: pin conn during async oplock break notification

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

CVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

EUVD-2026-55566

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...

CVE-2026-68380 accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...

CVE-2026-68380 accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...

CVE-2026-68380

CVE-2026-68380 affects the Linux kernel AMD XDNA accelerator driver (accel/amdxdna). The vulnerability arises when amdxdna_cmd_submit() stores current->mm in job->mm without a structural reference, and aie2_sched_job_run() later reads job->mm from the DRM scheduler worker thread. This cr...

CVE-2026-68380

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...

CVE-2026-68378

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered e.g. during driver module removal, a NULL pointer dereference can...