CVE-2026-72327 drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3dgetcpuindirectcsdparams looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes...

CVE-2026-72163

The vulnerability CVE-2026-72163 affects the Linux kernel OCFS2 journaling path. The issue arises in ocfs2_assure_trans_credits: when a journal aborts during DIO completion, a NULL h_transaction dereference can occur because the handle’s aborted state isn’t checked before reading remaining credit...

EUVD-2026-58921

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72163 ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL htransaction deref in ocfs2assuretranscredits BUG A direct write over unwritten extents can panic the kernel in ocfs2assuretranscredits when the journal aborts during DIO completion. The crash is a general...

CVE-2026-72090 accel/amdxdna: Use caller client for debug BO sync

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

EUVD-2026-59048

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdnadrmsyncboioctl looks up args-handle in the ioctl caller's drmfile. For SYNCDIRECTFROMDEVICE, it then calls amdxdnahwctxsyncdebugbo, but passes abo-client...

CVE-2026-68457

CVE-2026-68457 affects the Linux kernel ksmbd: FSCTL mutations (SET_SPARSE, SET_ZERO_DATA, SET_COMPRESSION) on an open SMB handle. The vulnerability arises because these operations call VFS helpers (xattr, fallocate, fileattr) using the current ksmbd worker credentials, which can revalidate inode...

EUVD-2026-59079

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

PT-2026-72407

In the Linux kernel, the following vulnerability has been resolved: lockd: Plug nlm file leak when nlm do fopen fails A client can repeatedly drive nlm do fopen failures by presenting file handles that the underlying export rejects. After kzalloc obj succeeds in nlm lookup file, the freshly...

PT-2026-72515

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject invalid indirect BO handle in indirect CSD setup v3d get cpu indirect csd params looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm...

PT-2026-72279

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna drm sync bo ioctl looks up args-handle in the ioctl caller's drm file. For SYNC DIRECT FROM DEVICE, it then calls amdxdna hwctx sync debug bo, but passes abo-client...

CVE-2026-68261

A flaw was found in the Linux kernel's drm/imagination component. A local user could exploit this vulnerability by passing an invalid virtual machine VM context handle to the DRMIOCTLPVRCREATECONTEXT ioctl. This improper error checking can lead to a kernel crash, resulting in a Denial of Service...

AZL-94953 CVE-2026-68312 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

DEBIAN-CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

UBUNTU-CVE-2026-68312

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68261

Technical details about CVE-2026-68261 are not publicly provided in the supplied documents; monitor for updates.

EUVD-2026-55362

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68239

CVE-2026-68239 affects the Linux kernel DRM TTM code, specifically the ttm_pool_backup path. The issue arises because ttm_pool_backup could encounter NULL or backup handle entries (ttm_backup_page_ptr_is_handle()) which were not safely guarded for set_pages_array_wb() and could be freed erroneous...

EUVD-2026-55546

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...