CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

UBUNTU-CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

UBUNTU-CVE-2026-68157

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

UBUNTU-CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

CVE-2026-68131

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

CVE-2026-68386

The CVE concerns the Linux kernel’s BPF sockmap path. It describes a vulnerability where unhashed UDP sockets accepted by sockmap can have their refcount incremented via a BPF lookup, and if the socket becomes bound, the subsequent bpf_sk_release() may skip decreasing the refcount, leading to a m...

CVE-2026-68325 iommu/amd: Bound the early ACPI HID map

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bound the early ACPI HID map The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before...

CVE-2026-68325

The Linux kernel AMD IOMMU path (ivrs_acpihid parser) is affected by CVE-2026-68325. The parser appends entries to a fixed four-element early_acpihid_map and, unlike the IOAPIC/HPET parsers, does not reject a fifth entry before increasing the map size. The patch adds a capacity check at the commo...

EUVD-2026-55426

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Bound the early ACPI HID map The ivrsacpihid command-line parser appends entries to a fixed four-element earlyacpihidmap array. Unlike the sibling IOAPIC and HPET parsers, it does not reject a fifth entry before...

EUVD-2026-55417

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316 accel: ethosu: Fix element size accounting for cmd stream validation

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316

The CVE affects the Linux kernel accel: ethosu component. Two issues in command stream validation lead to undercounted element sizes for 16/32/64-bit elements and, for NHWC format, missing element size in the calculation. The element-size bitfield differs between IFM/IFM2 (bits 2:3) and OFM (bits...

CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68158 libceph: Fix multiplication overflow in decode_new_up_state_weight()

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

CVE-2026-68158

CVE-2026-68158 (Linux kernel libceph) : A vulnerability in decoding CEPH_MSG_OSD_MAP can overflow when computing the length of the new_state portion, causing an overflowed bounds check and potentially out-of-bounds memory reads during osdmap decoding. The issue arises from a multiplication that m...

CVE-2026-68157 libceph: guard missing CRUSH type name lookup

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

CVE-2026-68157

CVE-2026-68157 affects the Linux kernel’s libceph CRUSH processing. When a malformed CRUSH map contains a parent bucket with a name but without a matching type, get_immediate_parent() dereferences a NULL type_cn and passes a NULL into strcmp(), causing a null-ptr-deref and potential system crash ...