CVE-2026-68285 LoongArch: BPF: Fix memory leak in bpf_jit_free()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If...

CVE-2026-68284 bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68283 tracing: Fix use-after-free freeing trigger private data

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

CVE-2026-68282 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

CVE-2026-68281 drm/imagination: Count paired job fence as dependency in prepare_job()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Count paired job fence as dependency in preparejob The DRM scheduler's preparejob callback counts the remaining non-signaled native dependencies for a job, preventing job submission until those plus job data and...

CVE-2026-68280 drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cdns-dsi: Replace deprecated UNIVERSALDEVPMOPS The deprecated UNIVERSALDEVPMOPS macro uses the provided callbacks for both runtime PM and system sleep. This causes the DSI clocks to be disabled twice: once during...

CVE-2026-68279 drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers drmdpsidebandparseremotedpcdread reads numbytes from the raw message and then unconditionally does: memcpybytes, &raw-msgidx, numbytes; without checking that idx...

CVE-2026-68278 drm/dp/mst: fix buffer overflows in sideband chunk accumulation

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

CVE-2026-68277 drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68276 drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68274 drm/xe/guc: Fix buffer overflow in steered register list allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

CVE-2026-68273 drm/amdgpu: Fix context pstate override handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

CVE-2026-68272 drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

CVE-2026-68271 drm/nouveau: fix reversed error cleanup order in ucopy functions

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

CVE-2026-68270 drm/sysfb: Avoid possible truncation with calculating visible size

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

CVE-2026-68269 drm/i915/gem: Add missing nospec on parallel submit slot

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...

CVE-2026-68268 drm/xe: Return error on non-migratable faults requiring devmem

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

CVE-2026-68267 drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RINGFORCETONONPRIVDENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RINGFORCETONONPRIVDENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default...

CVE-2026-68266 drm/xe: Hold a dma-buf reference for imported BOs

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...