CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68314

In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...

UBUNTU-CVE-2026-68378

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered e.g. during driver module removal, a NULL pointer dereference can...

CVE-2026-68098

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

Security Bulletin:Vulnerability in cifs-utils affects IBM Netezza Appliance

Summary The cifs-utils package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-12505 Vulnerability Details CVEID:CVE-2026-12505 DESCRIPTION: A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root...

UBUNTU-CVE-2026-68084

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: fix location monitor leak in tsi148 bridge tsi148probe allocates a location monitor resource and links it into tsi148bridge-lmresources. The probe error path frees this list, but tsi148remove only frees the dma,...

EUVD-2026-55614

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68428

The CVE describes a use-after-free in KVM’s x86/mmu related to vendor module reloads, where mmu_destroy_caches() leaves pointers to caches (pte_list_desc_cache and mmu_page_header_cache) in kvm.ko. When a vendor module unload occurs while kvm.ko remains loaded, a subsequent cache initialization c...

CVE-2026-68428 KVM: x86/mmu: Fix use-after-free on vendor module reload

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68428 KVM: x86/mmu: Fix use-after-free on vendor module reload

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68415

The CVE-2026-68415 entry documents a Linux kernel xfrm (IPSec) flaw where xfrm_state_gc_task can dereference stale mode_cbs after a failed IPTFS state setup and subsequent module unload. The root cause is failing to clear x->mode_cbs before publishing mode_data, allowing deferred GC to access ...

EUVD-2026-55601

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

EUVD-2026-55568

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68382

CVE-2026-68382 relates to the Linux kernel drm/xe/guc driver. The issue is a race during asynchronous destruction of GuC execution queues: if the final device reference is released while destruction is still pending, DRM cleanup may drain the same workqueue and deadlock. Mitigation implemented in...

CVE-2026-68378 dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered e.g. during driver module removal, a NULL pointer dereference can...

CVE-2026-68314

Summary (CVE-2026-68314): The Linux kernel MCTP I3C subsystem contains a defect in mctp_i3c_mod_init(): it registers the I3C bus notifier and then iterates existing buses before the I3C device driver is registered. If i3c_driver_register() fails, the error is returned without cleaning up the noti...

CVE-2026-68293

Summary (CVE-2026-68293) : A Linux kernel vulnerability in the net/mlx5 driver allows a buffer overflow when reading the MCIA register on devices advertising the mcia_32dwords capability. The function mlx5_query_mcia() may copy more bytes than the allocated output buffer, due to a mismatch betwee...

CVE-2026-68220

In the Linux kernel vulnerability CVE-2026-68220, the media: nxp: imx8-isi driver (mxc_isi_crossbar_init and mxc_isi_pipe_init) allocates v4l2_subdev state via v4l2_subdev_init_finalize but fails to free it during cleanup, causing a memory leak on every rmmod. The remediation is to add the missin...