CVE-2026-68446

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

EUVD-2026-57021

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

CVE-2026-68446 drm/vmwgfx: Validate vmw_surface_metadata::array_size

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

CVE-2026-68446

CVE-2026-68446 concerns the Linux kernel DRM VMware gfx driver (drm/vmwgfx), where the user-provided field vmw_surface_metadata::array_size is not validated against shader-model dependent limits. Multiple trusted sources (NVD, RH, Debian OSV/Debian CVE, Ubuntu, CIRCL, etc.) confirm the issue and ...

CVE-2026-68446

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

CVE-2026-68446 drm/vmwgfx: Validate vmw_surface_metadata::array_size

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

PT-2026-70980

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The Intel ALH digital-audio-interface driver contains an issue where the dai alh get properties function in drivers/dai/intel/alh/alh.c fails to validate the range of the caller-supplied strea...

PT-2026-70960

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw surface metadata::array size This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

CVE-2026-68259

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds in allocateeventnotificationslot The valid event ids go from 0 to KFDSIGNALEVENTLIMIT allocateeventnotificationslot has an option to specify an event id to allocate at, used by CRIU. We weren't checking t...

CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

AZL-94859 CVE-2026-68169 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

CVE-2026-68269 drm/i915/gem: Add missing nospec on parallel submit slot

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...

CVE-2026-68261 drm/imagination: fix error checking of pvr_vm_context_lookup()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

CVE-2026-68169 mptcp: pm: userspace: fix use-after-free in get_local_id

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

CVE-2026-68169

The CVE-2026-68169 entry documents a race in Linux kernel mptcp_pm_userspace_get_local_id() where an address entry is looked up under a spinlock but its id is read after the lock is released, allowing a concurrent delete to free the entry and cause a use-after-free. Concrete details show the issu...

EUVD-2026-55555

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

CVE-2026-68123 openvswitch: fix GSO userspace truncation underflow

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-68123 openvswitch: fix GSO userspace truncation underflow

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-68123

The CVE-2026-68123 issue affects the Linux kernel Open vSwitch path handling GSO packets in userspace. OVS_ACTION_ATTR_TRUNC previously stored a delta from the original skb length in OVS_CB(skb)->cutlen, and when a later segmenting action processed a GSO skb, queue_gso_packets() reused that de...

CVE-2026-11742

The kernel queue helper zqueuenodepeek in kernel/queue.c dereferences a node taken from a queue's dataq list, reading the node's flag byte and, for items enqueued via kqueueallocappend/allocprepend, the data pointer of an internally allocated allocnode struct. The implementations of...