CVE-2026-68406

A flaw was found in the cfg80211 component of the Linux kernel's Wi-Fi subsystem. This vulnerability allows the PMSR FTM request parser to accept preamble values outside the defined nl80211 range. An attacker could exploit this by providing malformed input, potentially leading to unexpected syste...

CVE-2026-68399

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component, specifically within the socket cloning mechanism. When a new socket is created and its cloning process fails prematurely, the new socket's BPF local storage may incorrectly reference the parent socket's storage. This can...

CVE-2026-68377

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

CVE-2026-68337

A flaw was found in the Linux kernel. The BPF Berkeley Packet Filter redirect helpers, specifically bpfredirect and skbdoredirect, can attempt to dereference a null pointer if a bpfnetcontext is not established. This can occur when certain BPF programs are attached to a network queueing disciplin...

CVE-2026-68351

A flaw was found in the carl9170 Wi-Fi driver in the Linux kernel. When the firmware sends a command response with a length mismatch, the carl9170cmdcallback function performs an out-of-bounds read. This occurs because the memcpy operation copies more data than the allocated buffer, potentially...

CVE-2026-68425

A flaw was found in the Linux kernel's InfiniBand IB Management Datagram mad component. A remote attacker could exploit this vulnerability by sending unsolicited Reliable Multicast Packet Protocol RMPP responses. This could lead to the kernel allocating or extending RMPP receive state for these...

CVE-2026-68349

A flaw was found in the Linux kernel, specifically within the carl9170 Wi-Fi driver. This vulnerability is a buffer overflow that occurs in the rxstream failover path. When processing certain USB transfers, the driver attempts to copy more data than its allocated buffer can hold. This can lead to...

CVE-2026-68353

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The ath6klwmitxcompleteeventrx function, responsible for handling Wi-Fi messages, does not properly validate the nummsg field provided by the firmware against the buffer length. A malicious or compromised firmware could send an inflated...

CVE-2026-68409

A flaw was found in the mac80211 Wi-Fi driver of the Linux kernel. When an MLO Multi-Link Operation link is removed, the RX statistics per-CPU buffer is freed immediately, while the link container is deferred to RCU Read-Copy-Update. This timing issue can lead to a use-after-free vulnerability,...

CVE-2026-68392

A flaw was found in the Linux kernel's Bluetooth management subsystem. This vulnerability occurs due to incorrect locking when handling memory pointers during device unpairing and disconnection. An attacker could exploit this to trigger a Use-After-Free UAF condition, which is a type of memory...

CVE-2026-68330

A flaw was found in the Linux kernel's airoha network driver. This vulnerability arises from an incorrect configuration of Direct Memory Access DMA for the Network Processing Unit NPU mailbox buffer. Specifically, the system incorrectly maps the buffer for data transfer only to the device, even...

CVE-2026-68352

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. The driver does not properly validate the lengths of firmware-controlled information elements IEs during a connect event. This vulnerability allows the sum of these lengths to exceed the allocated buffer, resulting in an out-of-bounds...

CVE-2026-68322

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. A local user can trigger a null pointer dereference by attempting to bind an RDS socket to an IPv6 address when IPv6 is explicitly disabled. This can lead to a system crash, resulting in a Denial of Service DoS...

CVE-2026-68332

A flaw was found in the airoha network driver within the Linux kernel. This vulnerability, a use-after-free, occurs because the airohappedeinit function fails to properly synchronize memory deallocation with ongoing operations. An attacker could potentially exploit this to cause system instabilit...

CVE-2026-68307

A flaw was found in the MediaTek mt7925 Wi-Fi driver within the Linux kernel. During a reset recovery process, the driver can attempt to access a network configuration that no longer exists. This can lead to a null pointer dereference, causing the system to crash and resulting in a Denial of...

CVE-2026-68287

A flaw was found in the Linux kernel's dropmonitor feature. Incorrect size calculations for 64-bit attributes on 32-bit architectures without efficient unaligned access support can lead to an under-estimation of internal buffer SKB size. This under-estimation may cause a kernel panic, resulting i...

CVE-2026-68284

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the tcpbpfsendmsg function within the BPF Berkeley Packet Filter and sockmap components. This flaw occurs when two threads attempt to send data on the same socket concurrently, leading to an incorrect memory...

CVE-2026-68421

A flaw was found in the Linux kernel's schedext component. The putprevtaskscx function incorrectly issues a warning when a runnable task transitions to an idle state due to core scheduling. This occurs because the core scheduling mechanism bypasses certain checks, leading to a misleading warning...

CVE-2026-68327

A flaw was found in the Linux kernel's wanxl driver. During the initialization process, an error handling path in the wanxlpciremoveone function can lead to a null pointer dereference. This occurs when the wanxlreset function attempts to access hardware resources before they are properly mapped,...

CVE-2026-68213

A flaw was found in the Linux kernel's media subsystem, specifically within the rtl2832sdr driver. When the startstreaming function encounters an error, it fails to properly return buffers that were previously queued. This oversight can lead to a memory leak, potentially resulting in resource...