CVE-2026-68461

In the Linux kernel, CVE-2026-68461 is resolved by fixing fwnode_init() so that fwnode_handle and its secondary pointer are initialized (setting fwnode->secondary to NULL and initializing remaining fields). This prevents a firmware node allocated on stack/heap with non-zeroing allocation from ...

EUVD-2026-59084

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68462

Summary of CVE-2026-68462 (Linux kernel, BPF): The issue arises in the verifier’s handling of buffer-pointer access (PTR_TO_TP_BUFFER and PTR_TO_BUF) where a constant negative offset could slip through after a pointer offset split (reg->var_off vs reg->off). Specifically, an access with reg...

CVE-2026-68462

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68461

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnodehandle in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing...

CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68460

CVE-2026-68460 : The Linux kernel fix addresses a deadlock in the f2fs balance path when the filesystem space is nearly exhausted. The affected component is f2fs (file system in user-space on Linux) and the underlying issue occurs in f2fs_balance_fs(), leading to multiple stalled kernel tasks and...

CVE-2026-68460 f2fs: fix potential deadlock in f2fs_balance_fs()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fsbalancefs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...

CVE-2026-68460

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fsbalancefs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...

EUVD-2026-59082

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in f2fsbalancefs When the f2fs filesystem space is nearly exhausted, we encounter deadlock issues as below: INFO: task A:1890 blocked for more than 120 seconds. Tainted: G O 6.12.41-g3fe07ddf05ab 1...

CVE-2026-68459

CVE-2026-68459 describes a resolved Linux kernel issue affecting the f2fs filesystem. When mounting with the gc_merge option, a deadlock can occur in the gc_merge path of f2fs_balance_fs(), involving a chain from f2fs_write_cache_pages to folio locks and the GC thread waitqueue. The provided refe...

CVE-2026-68459

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

CVE-2026-68459 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

EUVD-2026-59081

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

CVE-2026-68457

CVE-2026-68457 affects the Linux kernel ksmbd: FSCTL mutations (SET_SPARSE, SET_ZERO_DATA, SET_COMPRESSION) on an open SMB handle. The vulnerability arises because these operations call VFS helpers (xattr, fallocate, fileattr) using the current ksmbd worker credentials, which can revalidate inode...

CVE-2026-68458 binder: cache secctx size before release zeroes it

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

CVE-2026-68457 ksmbd: use opener credentials for FSCTL mutations

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-68458

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...

CVE-2026-68458

CVE-2026-68458 concerns the Linux kernel Binder subsystem. A vulnerability arises in binder_transaction() where the end of the scatter-gather buffer area is computed using a value derived from lsmctx.len after security_release_secctx() zeroes that field. This causes sg_buf_end_offset to be inflat...

EUVD-2026-59080

In the Linux kernel, the following vulnerability has been resolved: binder: cache secctx size before release zeroes it bindertransaction bounds the scatter-gather buffer area with sgbufendoffset and subtracts the aligned LSM context size because the secctx is written at the tail of that area. The...