UBUNTU-CVE-2026-68361

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-psu Stop device IO before calling hidhwstop hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of hiddeviceiostart withi...

UBUNTU-CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

UBUNTU-CVE-2026-68322

In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...

UBUNTU-CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

UBUNTU-CVE-2026-68402

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

UBUNTU-CVE-2026-68363

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

UBUNTU-CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

UBUNTU-CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68188

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

UBUNTU-CVE-2026-68156

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth-authorizerbuf,len after authorizer update cephxcreateauthorizer caches au-buf-vec.iovbase and au-buf-vec.iovlen in struct cephauthhandshake. These cached values are then used by the messenger connect code wh...

UBUNTU-CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

UBUNTU-CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

CVE-2026-68402

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68169

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

DEBIAN-CVE-2026-68144

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: fix use-after-free in pepgetsb pepgetsb doesn't consider that pskbmaypull might have relocated the skb data, and continue to access the older pointer, causing UAF. Reproduced under KASAN: BUG: KASAN:...

CVE-2026-68189

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

UBUNTU-CVE-2026-68335

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...