DEBIAN-CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68400

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68398

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

CVE-2026-68396

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsischeduleeh Drivers which use the scsischeduleeh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There...

CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

DEBIAN-CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

DEBIAN-CVE-2026-68333

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: put MAC endpoint device on disconnect fslmcgetendpoint returns the MAC endpoint device with a reference taken through devicefindchild. The switch port connect path stores that device in mac-mcdev and keeps it for th...

CVE-2026-68332

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for existing RCU readers to exit before calling ppedeinit and airohanpuput...

DEBIAN-CVE-2026-68326

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs that the firmware copies into the event: sinfo-assocreqies =...

DEBIAN-CVE-2026-68314

In the Linux kernel, the following vulnerability has been resolved: net: mctp i3c: clean up notifier and buses if driver register fails mctpi3cmodinit registers the I3C bus notifier and then walks the existing buses with i3cforeachbuslockedmctpi3cbusaddnew, NULL before registering the I3C device...

DEBIAN-CVE-2026-68317

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix auxiliary device add/del races Two paths add or delete the same slot pf-vfsvfid.padev: a VF's pdscresetdone and the PF's devlink enablevnet/disablevnet handler. They serialize on configlock, but neither guards the sl...

DEBIAN-CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

DEBIAN-CVE-2026-68278

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix buffer overflows in sideband chunk accumulation drmdpsidebandappendpayload has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunklen underflow: msglen is a 6-bit field...

DEBIAN-CVE-2026-68251

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87...

DEBIAN-CVE-2026-68252

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

DEBIAN-CVE-2026-68206

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC active reference counts HEVC slice parameters are shared stateless V4L2 controls, but the common validation path does not verify the active L0/L1 reference counts before driver-specific code...

CVE-2026-68204

In the Linux kernel, the following vulnerability has been resolved: media: vivid: check for vb2isbusy when toggling caps The vividupdateformatcap/out functions must only be called if the capture/output queue are not busy. But for the controls that select the CROP/COMPOSE/SCALE capability that is...

DEBIAN-CVE-2026-68194

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: drop TXRXNOTIFY on non-mmio buses PKTTYPETXRXNOTIFY is an mmio-only event, but mt7921rxcheck and mt7921queuerxskb dispatch it to mt7921mactxfree on every bus. mt7921mactxfree cleans the DMA tx queues with...