CVE-2026-68219

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respo...

CVE-2026-68200

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68182

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

CVE-2026-68202

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

UBUNTU-CVE-2026-68182

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

CVE-2026-68395

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

CVE-2026-68182

In the Linux kernel, the following vulnerability has been resolved: comedi: comediparport: deal with premature interrupt Syzbot reported a general protection fault in comedigetissubdevicerunning, which was called from the interrupt handler parportinterrupt in the "comediparport" driver, but it do...

UBUNTU-CVE-2026-68395

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

UBUNTU-CVE-2026-68241

In the Linux kernel, the following vulnerability has been resolved: drm/i915/mst: limit DP MST ESI service loop The loop in inteldpcheckmststatus keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to n...

CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

UBUNTU-CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68087

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFPATOMIC in wacomwacqueueflush wacomwacqueueflush is called via the .rawevent callback wacomrawevent → wacomwacpenserialenforce → wacomwacqueueflush. For USB HID devices, this callback is invoked from hidirqin,...

CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

EUVD-2026-55591

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68405

CVE-2026-68405 (Linux kernel, wifi/mac80211) describes a bug where AP_VLAN bc_buf SKBs could be freed outside the IRQ lock. During ieee80211_do_stop(), AP_VLAN packets are removed from ps->bc_buf while ps->bc_buf.lock is held with IRQs disabled, then ieee80211_free_txskb() is called after r...

CVE-2026-68395

CVE-2026-68395 pertains to the Linux kernel’s SATA DWC 460ex driver. The issue was that sata_dwc_enable_interrupts() was executed before the IRQ handler and related initialization (platform_get_irq(), ata_host_activate()), leaving the SATA controller’s interrupt mask enabled without a registered ...

EUVD-2026-55581

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

CVE-2026-68395 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

CVE-2026-68365 USB: serial: io_edgeport: cap received transmit credits

In the Linux kernel, the following vulnerability has been resolved: USB: serial: ioedgeport: cap received transmit credits The interrupt-status packet reports transmit credits returned by the device. edgeinterruptcallback adds the 16-bit value to txCredits without checking maxTxCredits. edgewrite...