CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68260

CVE-2026-68260 affects the Linux kernel, specifically the drm/imagination driver. The issue arises because the GPU VM code does not properly synchronize find operations with map/unmap operations, allowing a race that can lead to a NULL pointer dereference in certain memory operations. The resolve...

CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

EUVD-2026-55346

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

CVE-2026-68245 drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix lifetime issue of amdgpuvmgettaskinfopasid The vm pointer returned from amdgpuvmgetvmfrompasid is only valid while the lock is still being held. Once xaunlockirqrestore is called and returned, the pointer is no...

EUVD-2026-55290

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189 Bluetooth: hci_sync: Protect UUID list traversal

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Protect UUID list traversal The hcisync conversion moved class-of-device and EIR generation from an HCI request built under hdev-lock to asynchronous command sync work. The worker holds hdev-reqlock, but that...

CVE-2026-68189

CVE-2026-68189 affects the Linux kernel Bluetooth hci_sync component. A race between asynchronous command sync work and UUID list updates can cause a use-after-free in eir_create due to non-serialized access to hdev->uuids. The fix/mitigation is to hold hdev->lock while generating and commi...

EUVD-2026-55282

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access meidevice under devicelock on cleanup Fix couple of problems in meiclbusdevrelease: meiclflushqueues is running without lock. bus-filelist access after meidevbusputbus can become a use-after-free if this was the...

CVE-2026-68181

In the Linux kernel, CVE-2026-68181 affects the mei bus cleanup path. The vulnerability arises in mei_cl_bus_dev_release() where mei_cl_flush_queues() runs without holding a lock, and subsequent access to bus->file_list after mei_dev_bus_put(bus) can lead to a use-after-free if it was the last...

CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

CVE-2026-68179

CVE-2026-68179 affects the Linux kernel NSM: nsm_dev_ioctl() may unlock a mutex that was never acquired when pre-lock copy_from_user() fails, risking a local DoS. A patch changes control flow to return immediately on pre-lock failures and to keep the unlock path for post-lock errors only. The vul...

EUVD-2026-55280

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

EUVD-2026-55556

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68143 net: slip: serialize receive against buffer reallocation

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68137

The CVE-2026-68137 issue is a Linux kernel use-after-free in the X.25 networking code (x25_kill_by_neigh). The vulnerability arises when the kernel walks the global X.25 socket list without guaranteeing socket lifetime after dropping x25_list_lock, allowing a concurrent close to remove a socket a...

EUVD-2026-55507

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

EUVD-2026-55477

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in auditdupeexe A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved e.g., via dorenameat2, the VFS layer locks the parent directory...

CVE-2026-68096 audit: fix recursive locking deadlock in audit_dupe_exe()

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in auditdupeexe A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved e.g., via dorenameat2, the VFS layer locks the parent directory...