CVE-2026-68346 ALSA: hda: cs35l41: validate and free ACPI mute object

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the...

CVE-2026-68345 arm_mpam: guard MBWU state before adding it to garbage

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

CVE-2026-68345

CVE-2026-68345 : In the Linux kernel, the vulnerability arises in arm_mpam where __destroy_component_cfg() adds each RIS mbwu_state to the MPAM garbage list. Since mbwu_state is allocated per RIS only for RISes with MBWU monitors, a component can have comp->cfg allocated while some RISes have ...

EUVD-2026-55446

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

CVE-2026-68337 bpf: Reject redirect helpers without a bpf_net_context

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

CVE-2026-68336 bonding: fix devconf_all NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...

CVE-2026-68336

In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...

CVE-2026-68334 rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

CVE-2026-68328 nfp: Check resource mutex allocation

In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...

CVE-2026-68328

The CVE relates to the Linux kernel nfp subsystem. Specifically, nfp_cpp_resource_find() allocates a CPP mutex handle for a matching resource-table entry, and nfp_resource_try_acquire() passes that handle to nfp_cpp_mutex_trylock(). If nfp_cpp_mutex_alloc() fails and returns NULL, the resource lo...

CVE-2026-68328 nfp: Check resource mutex allocation

In the Linux kernel, the following vulnerability has been resolved: nfp: Check resource mutex allocation nfpcppresourcefind allocates a CPP mutex handle for the matching resource-table entry and then reports success. nfpresourcetryacquire immediately passes that handle to nfpcppmutextrylock...

CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

EUVD-2026-55428

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68327 wan: wanxl: Only reset hardware after BAR mapping

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68322

CVE-2026-68322 concerns the Linux kernel RDS subsystem. When IPv6 is explicitly disabled with ipv6.disable=1, inet6_addr_lst is never initialized, because inet6_init() exits before addrconf_init() runs. This leads to a NULL dereference in __ipv6_chk_addr_and_flags() when attempting to bind an RDS...

CVE-2026-68322 rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...

CVE-2026-68322

In the Linux kernel, the following vulnerability has been resolved: rds: Fix inet6addrlst NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, inet6addrlst is never initialized because inet6init exits before addrconfinit is called to initialize it. An attempt t...

CVE-2026-68317 pds_core: fix auxiliary device add/del races

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix auxiliary device add/del races Two paths add or delete the same slot pf-vfsvfid.padev: a VF's pdscresetdone and the PF's devlink enablevnet/disablevnet handler. They serialize on configlock, but neither guards the sl...

CVE-2026-68311 wifi: mt76: mt7925: guard link STA in decap offload

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...

EUVD-2026-55412

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...