CVE-2026-68305

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

CVE-2026-68361

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-psu Stop device IO before calling hidhwstop hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of hiddeviceiostart withi...

CVE-2026-68367

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: synchronize delayed setalt with teardown The ftcm setalt path defers endpoint setup to a work item and completes the delayed status response from process context. The delayed work uses ftcm private state and ma...

CVE-2026-68347

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING: HARDIRQ-safe - HARDIRQ-unsafe lock order detected 259.424667...

CVE-2026-68421

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

CVE-2026-68363

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68150

In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of sumount dothawall iterates over all superblocks via iteratesupers with SUPERITEREXCL, which acquires sumount exclusively before calling the callback and releases it afterwards. Howeve...

CVE-2026-68188

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

UBUNTU-CVE-2026-68188

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...

UBUNTU-CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

UBUNTU-CVE-2026-68237

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix indefinite fence wait during GPU reset prereset only force-completes fences of MAPPED queues. A queue in any other state e.g. mid-eviction keeps its lastfence pending; after a GPU reset that fence never...

UBUNTU-CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

UBUNTU-CVE-2026-68363

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request ath9khifrequestfirmware re-arms an asynchronous firmware load via requestfirmwarenowait, passing hifdev as the completion context, and then still...

UBUNTU-CVE-2026-68291

In the Linux kernel, the following vulnerability has been resolved: idpf: fix maxvport related crash on allocation error during init Set adapter-maxvports only after successful allocation of vports, netdevs and vportconfig buffers. This fixes possible crashes on reset or rmmod, following failed...

UBUNTU-CVE-2026-68336

In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconfall NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the devconfall is never initialized because inet6init exits before addrconfinit is called which initializes it...

UBUNTU-CVE-2026-68420

In the Linux kernel, the following vulnerability has been resolved: xfrm: reject optional IPTFS templates in outbound policies syzbot reported a stack-out-of-bounds read in xfrmstatefind which flows from xfrmtmplresolveone. Commit 3d776e31c841 "xfrm: Reject optional tunnel/BEET mode templates in...

UBUNTU-CVE-2026-68337

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

UBUNTU-CVE-2026-68239

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can be passed to setpagesarraywb or freed. Add a dedicated WB pass before...

UBUNTU-CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...