KVM: s390: pci: Fix handling of AIF enable without AISB

...

CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68391

CVE-2026-68391 affects the Linux kernel Bluetooth management path, specifically the mgmt_pending_cmds handling of hci_conn references. The issue is a Use-After-Free risk from dereferencing RCU-protected pointers outside critical sections and from using hci_conn in hci_sync callbacks without holdi...

CVE-2026-68386

The CVE concerns the Linux kernel’s BPF sockmap path. It describes a vulnerability where unhashed UDP sockets accepted by sockmap can have their refcount incremented via a BPF lookup, and if the socket becomes bound, the subsequent bpf_sk_release() may skip decreasing the refcount, leading to a m...

EUVD-2026-55572

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68363 wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68359 hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-smart2 Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of hiddeviceiosta...

CVE-2026-68358 hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop

In the Linux kernel, the following vulnerability has been resolved: hwmon: nzxt-kraken3 Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of...

CVE-2026-68357 watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

In the Linux kernel, the following vulnerability has been resolved: watchdog: pretimeout: Fix UAF in watchdogunregistergovernor When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to defaultgov. If the governor being...

CVE-2026-68339

The Linux kernel Bluetooth btusb vulnerability CVE-2026-68339 stems from btusb_recv_event_realtek() inspecting data[0] and data[2] before verifying the HCI event header and first parameter. This can cause misclassification of a vendor event as a coredump (e.g., a 2-byte event ff 00 with adjacent ...

CVE-2026-68334 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

CVE-2026-68329

CVE-2026-68329 affects the Linux kernel’s iommu/amd path. A race in iommu_completion_wait() can cause it to return before all previously queued commands complete, enabling a use-after-free window where stale page-table translations may be used. The issue stems from need_sync being read locklessly...

CVE-2026-68324 iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

In the Linux kernel, the following vulnerability has been resolved: iommu/intel: Fix out-of-bounds memset in dmarlatencydisable dmarlatencydisable intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeoflstat DMARLATENCYNUM, which...

CVE-2026-68322

CVE-2026-68322 concerns the Linux kernel RDS subsystem. When IPv6 is explicitly disabled with ipv6.disable=1, inet6_addr_lst is never initialized, because inet6_init() exits before addrconf_init() runs. This leads to a NULL dereference in __ipv6_chk_addr_and_flags() when attempting to bind an RDS...

EUVD-2026-55418

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix auxiliary device add/del races Two paths add or delete the same slot pf-vfsvfid.padev: a VF's pdscresetdone and the PF's devlink enablevnet/disablevnet handler. They serialize on configlock, but neither guards the sl...

CVE-2026-68313 tipc: fix infinite loop in __tipc_nl_compat_dumpit

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

CVE-2026-68312 cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

In the Linux kernel, the following vulnerability has been resolved: cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths In cifsclosedeferredfile, cifsclosealldeferredfiles, and cifsclosedeferredfileunderdentry, when a pending deferred close is cancelled via...

CVE-2026-68312

The CVE-2026-68312 issue affects the Linux kernel CIFS code path handling deferred file close. A kmalloc_obj() failure during cancellation of a pending deferred close could prevent a cifsFileInfo from being added to the local processing list, causing leaks of the cifsFileInfo reference and the op...

EUVD-2026-55399

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...