CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

DEBIAN-CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68147

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...

CVE-2026-68162

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68372

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

CVE-2026-68302

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr or the AMT message header and then call a helper that can reallocate that head befo...

CVE-2026-68341

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via ovpnpeerput. If this drops the last reference, the peer is eventually...

CVE-2026-68357

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

CVE-2026-68201

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it sndtimercloselocked drains the closing instance's own in-flight callback IFLGCALLBACK before freeing it, but not its slaves'. When a master instance is closed,...

CVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68148

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...

CVE-2026-68200

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68290

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

CVE-2026-68192

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

CVE-2026-68377

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

UBUNTU-CVE-2026-68283

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

UBUNTU-CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

UBUNTU-CVE-2026-68148

In the Linux kernel, the following vulnerability has been resolved: fscrypt: Add missing superblock check in findorinsertdirectkey The legacy 'fscryptdirectkeys' table caches master keys that are used by v1 encryption policies that have FSCRYPTPOLICYFLAGDIRECTKEY. It's just a global table for all...