CVE-2026-68308

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68308

CVE-2026-68308 details a Linux kernel issue in the mt76 mt7996 driver where the routine mt76_connac_get_he_phy_cap() can theoretically return NULL. The vulnerability arises from dereferencing the cap pointer without validating it first; the fix is to check the pointer before use. The issue has be...

CVE-2026-68308 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68307 wifi: mt76: mt7925: fix crash in reset link replay

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

EUVD-2026-55407

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68306 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68306

In the Linux kernel, the wifi mt76 mt7996 driver vulnerability CVE-2026-68306 could cause a NULL pointer dereference in mt7996_mcu_sta_bfer_eht() if mt76_connac_get_eht_phy_cap() returns NULL. The advisory notes that the cap pointer must be checked before dereferencing it, and the issue has been ...

CVE-2026-68305

The CVE-2026-68305 entry describes a kernel vulnerability in the Linux DRM subsystem, specifically drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers. The issue occurs when CCS read/write buffers are freed during BO destruction while the DRM structure remains valid, allowing a NU...

CVE-2026-68305 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

EUVD-2026-55406

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

CVE-2026-68305 drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

EUVD-2026-55404

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed before its dependent drivers vc4hvs/vc4v3d the vc4hvsunbind/vc4v3dunbind...

CVE-2026-68303

The CVE-2026-68303 entry describes a Linux kernel fix in drm/vc4: hvs/v3d where unbind functions used dev_get_drvdata(master). When vc4-drm is removed before dependent drivers, vc4_hvs_unbind/vc4_v3d_unbind could dereference a freed pointer. The remediation is to use the data pointer passed to th...

CVE-2026-68303 drm/vc4: hvs/v3d: Fix null dereference in unbind

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed before its dependent drivers vc4hvs/vc4v3d the vc4hvsunbind/vc4v3dunbind...

CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

EUVD-2026-55401

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68282

In the Linux kernel DRM/rockchip stack (analogix_dp), a missing error check for platform_get_resource() return value could lead to a NULL pointer dereference if memory resource is unavailable. The provided descriptions indicate this has been resolved by adding the necessary error check. No exploi...

EUVD-2026-55383

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

CVE-2026-68282 drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogixdp: Add missing error check for platformgetresource Add missing error check for platformgetresource return value to prevent NULL pointer dereference when memory resource is not available...

CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...