CVE-2026-68424

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...

CVE-2026-68423

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...

CVE-2026-68422

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in mergerelocroots If we have an unexpected relocroot for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missi...

CVE-2026-68419

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent reregmr for non-mem regions When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal regmr mechanism prior to creating the...

CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

CVE-2026-68416

In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARNON in addmtddevice error paths When deviceregister or mtdnvmemadd fails inside addmtddevice for a partition, the error handling triggers mtdrelease via putdevice or deviceunregister. mtdrelease calls...

CVE-2026-68415

In the Linux kernel, the following vulnerability has been resolved: xfrm: clear mode callbacks after failed mode setup xfrmstategctask can run long after a failed IPTFS state setup. In the reproduced case, xfrminitstate cached x-modecbs, IPTFS setup returned -ENOMEM before publishing modedata, an...

CVE-2026-68413

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68409

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU staremovelink frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: stainfofreelink&alloc-info; kfreercualloc, rcuhead; The...

CVE-2026-68408

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the request's nlportid and queues pmsrfreewk to call cfg80211pmsrprocessabort...

CVE-2026-68406

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate PMSR FTM preamble range PMSR FTM request parsing accepts preamble values outside the enumerated nl80211 preamble range. Reject out-of-range values before using them in the parser capability bit test using...

CVE-2026-68405

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

CVE-2026-68403

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

CVE-2026-68402

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68401

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

CVE-2026-68400

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68399

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68397

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-68395

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...