CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

EUVD-2026-55563

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68377

CVE-2026-68377 affects the Linux kernel net/sched component, specifically act_tunnel_key. The issue is a race leading to use-after-free during tunnel_key_release_params() where metadata_dst is released synchronously via dst_release() while the old params are freed with kfree_rcu(), allowing a con...

CVE-2026-68377 net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

CVE-2026-68375 bnxt_en: Handle partially initialized auxiliary devices

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68375

The CVE affects bnxt_en in the Linux kernel. bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. If allocation fails after auxiliary_device_init(), the release path can dereference or clear partially initialized state. The fix is...

EUVD-2026-55561

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68342

Technical details are not publicly available in the provided documents. No exposed affected products, versions, or exploit information is present; monitor for updates.

EUVD-2026-55443

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68342 ovpn: avoid putting unrelated P2P peer on socket release

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

CVE-2026-68327

In the Linux kernel, the following vulnerability has been resolved: wan: wanxl: Only reset hardware after BAR mapping wanxlpciinitone stores the freshly allocated card in driver data before the PLX BAR is mapped. Several early probe failures then unwind through wanxlpciremoveone, including failur...

CVE-2026-68257

The CVE-2026-68257 vulnerability affects the Linux kernel drm/amdkfd component where a 32-bit overflow in the CWSR total size calculation could yield an undersized BO/SVM allocation. The root cause is that total_cwsr_size was computed in 32-bit before being used, and large ctx_save_restore_area_s...

EUVD-2026-55358

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation totalcwsrsize was computed in 32-bit before being used as a BO/SVM allocation size. With large ctxsaverestoreareasize and debugmemorysize multiplied by the XCC count,...

CVE-2026-68236 drm/amd/display: set new_stream to NULL after release

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

CVE-2026-68236

CVE-2026-68236 : In the Linux kernel, the drm/amd/display path (dm_update_crtc_state) releases a stream pointer (new_stream) but fails to NULL it. If an error occurs later, the code may call dc_stream_release() again on the same dangling pointer, causing a double release and use-after-free. The f...

EUVD-2026-55337

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

CVE-2026-68236 drm/amd/display: set new_stream to NULL after release

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set newstream to NULL after release In dmupdatecrtcstate, the skipmodeset path releases newstream via dcstreamrelease but does not set the pointer to NULL. If a later error e.g., color management failure triggers...

CVE-2026-68226 media: cx23885: add ioremap return check and cleanup

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pciioremapbar in cx23885devsetup. If ioremap for BAR0 fails, release the already allocated PCI memory region, decrement the device count, an...

CVE-2026-68223

The CVE covers a Linux kernel fix in media: meson: vdec where vdec_open() previously skipped releasing the m2m context when vdec_init_ctrls() failed, causing a memory/resource leak. The patch adds an explicit err_m2m_ctx_release path that calls v4l2_m2m_ctx_release(sess->m2m_ctx) before releas...

EUVD-2026-55324

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: Fix memory leak in error path of vdecopen The vdecopen function previously jumped directly to errm2mrelease when vdecinitctrls failed, skipping release of the m2m context. This caused a resource leak. Fix it b...