PT-2026-69502

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amdgpu hmm invalidate gfx function within the drm/amdgpu component. During the allocation or freeing process, a userptr BO Buffer Object may temporarily not be par...

CVE-2026-68275: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68239: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

CVE-2026-68174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68378: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpll: fix NULL pointer dereference in dpllmsgaddpinrefsync When a dpllpin is shared across multiple dplldevice instances and those devices are being unregistered e.g. during driver module removal, a NULL pointer dereference can...

CVE-2026-68305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

PT-2026-69591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the irq work sync function, which is called by rhashtable destroy, when unbinding the ath12k driver. This issue affects the ath12k link sta hash tabl...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.1 contains security vulnerabilities. These vulnerabilities stem from an issue in the amdgpu context pstate processing code, where the amdgpuctxinit function does not properly hold the stablepstatectxlock lock. This may lead to reusing a locked resource after it has been...

CVE-2026-68291: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

PT-2026-69691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the idpf driver where a kernel NULL pointer dereference can occur. This happens when adapter-max vports is set before the successful allocation of vports, netdevs, and...

PT-2026-69818

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/irdma component where a user can trigger a null pointer dereference during Queue Pair QP creation. This occurs because the system only attempts to populate th...

CVE-2026-68193: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7925rxcheck and mt7925queuerxskb dispatch it to mt7925mactxfree on every bus. mt7925mactxfree cleans the DMA tx queues with...

CVE-2026-68310: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: guard HE capability lookups mt7915mcubsshetlv and mt7915mcustabfertlv both run after checking HE support, then dereference the HE PHY capability returned by mt76connacgethephycap. That helper can return NULL...

PT-2026-69539

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the Linux kernel during PCIe DPC Downstream Port Containment recovery. When the mlx5 driver reloads functions and replays multiport affiliation event...

CVE-2026-68225: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: i2c: alvium: fix critical pointer access in alviumctrlinit The current implementation of alviumctrlinit creates several controls in function alviumctrlinit and uses the returned pointer without check. That can cause write...

PT-2026-69593

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the RX worker of the Linux kernel when handling PKT TYPE TXRX NOTIFY events on non-mmio buses, such as USB. The functions mt7925 rx check and mt7925...

PT-2026-69648

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/i915 component where the active instance function fails to return NULL upon encountering an error. Specifically, the system may incorrectly return &node-base...

PT-2026-69675

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the amdgpu gem op ioctl function within the AMDGPU GEM OP GET MAPPING INFO path. The issue occurs because the function calls amdgpu vm bo find to loo...

CVE-2026-68243: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915CONTEXTPARAMSSEU Setting context engine slot N into I915ENGINECLASSINVALID / I915ENGINECLASSINVALIDNONE and attempting to apply I915CONTEXTPARAMSSEU to the same slot N will deref NULL. Fix that...

CVE-2026-68136: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...