EUVD-2026-55341

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

CVE-2026-68239 drm/ttm: Account for NULL and handle pages in ttm_pool_backup

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68227

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than parent USB device. This avoids issues like memory leaks when...

CVE-2026-68225 media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

CVE-2026-68223 media: meson: vdec: Fix memory leak in error path of vdec_open

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...

CVE-2026-68219

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respo...

CVE-2026-68216

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

CVE-2026-68206 media: v4l2-ctrls: validate HEVC active reference counts

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68200 ALSA: timer: don't re-enter an instance callback that is still running

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68200 ALSA: timer: don't re-enter an instance callback that is still running

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer utimer TRIGGER ioctl calls sndtimerinterrupt directly with no serialization, so two threads triggering the same utimer can run...

CVE-2026-68197

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being present, but then dereferences a different pointer, bssdesc-bcnhtoper...

CVE-2026-68192 wifi: brcmfmac: make release_scratchbuffers idempotent

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoherent but does not clear the pointers afterwards, unlike the sibling...

CVE-2026-68190

CVE-2026-68190 affects the Linux kernel staging/rtl8723bs driver, specifically the function rtw_get_wps_ie() in processing of IE data from network frames. The vulnerability arises from insufficient bounds checking: the code reads in_ie[cnt+1] without verifying cnt+1

CVE-2026-68166 userfaultfd: prevent registration of special VMAs

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...

CVE-2026-68164

The CVE concerns the Linux kernel DAMON subsystem, specifically the function damon_set_regions() in mm/damon/core. The root cause was that input ranges were assumed to be sorted and non-overlapping, but a prior commit removed validation, allowing overlapping ranges. The consequence can be odd mon...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68163 mm/page_vma_mapped: fix device-private PMD handling

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68159

CVE-2026-68159 (Linux kernel libceph bound check) : The issue occurs when decoding pg_temp/pg_upmap entries in libceph within the kernel. __decode_pg_temp() may accept a user-controlled length that overflows the allocation, and the same applies to __decode_pg_upmap_items(); decoded data is later ...

CVE-2026-68156

The CVE-2026-68156 issue affects the Linux kernel libceph path: during an authorizer update, ceph_x_update_authorizer() may rebuild the authorizer and, if the new authorizer won’t fit in the existing buffer, it frees the old buffer while auth->authorizer_buf still points to the freed memory. A...