CVE-2026-68407 wifi: nl80211: free RNR data on MBSSID mismatch

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

CVE-2026-68406 wifi: cfg80211: validate PMSR FTM preamble range

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...

CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68404 wifi: cfg80211: use wiphy work for socket owner autodisconnect

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is released. If the socket owns a connection, the notifier queues the embedd...

CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68401 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

EUVD-2026-55585

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68399

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68399

CVE-2026-68399: Linux kernel BPF sock_clone UAF fixed by resetting newsk->sk_bpf_storage to NULL after sock_copy() (in sk_clone) and removing redundant init in bpf_sk_storage_clone. Exploit could lead to use-after-free of parent socket’s BPF storage with potential DoS or arbitrary code executi...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68398 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-68396 scsi: core: wake eh reliably when using scsi_schedule_eh

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

CVE-2026-68395 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

CVE-2026-68394 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68393 Bluetooth: hci_sync: extend conn_hash lookup critical sections

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

CVE-2026-68392 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...