CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

EUVD-2026-55550

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68164 mm/damon/core: disallow overlapping input ranges for damon_set_regions()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow overlapping input ranges for damonsetregions damonsetregions assumes the input ranges are sorted by the address and don't overlap each other. Hence the assumption was initially to be explicitly validated...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

EUVD-2026-55541

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155 libceph: Reject monmaps advertising zero monitors

In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPHMSGMONMAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the existing monitors in the cluster. Currently...

CVE-2026-68155

CVE-2026-68155 affects the Linux kernel libceph component. A crafted monmap advertising zero monitors can be treated as valid, potentially crashing the client when opening a session (DoS) due to BUG_ON(monc->monmap->num_mon

EUVD-2026-55540

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154 libceph: reject zero bucket types in crush_decode

In the Linux kernel, the following vulnerability has been resolved: libceph: reject zero bucket types in crushdecode CRUSH bucket type 0 is reserved for devices. The mapper relies on that invariant and uses type 0 to identify leaf devices. If crushdecode accepts a bucket with type 0, a malformed...

CVE-2026-68154

The CVE-2026-68154 vulnerability affects the Linux kernel’s libceph component, where CRUSH map decoding accepts bucket type 0 (reserved for devices) can let a malformed map cause a negative bucket ID to index the OSD weight array, leading to denial of service. The issue is fixed by rejecting zero...

EUVD-2026-55529

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-68145

CVE-2026-68145 describes a Linux kernel iomap vulnerability where zero-length ranges in ifs_set_range_dirty() and ifs_set_range_uptodate() cause an unsigned underflow in (off + len - 1) >> i_blkbits, producing a huge last_blk and nr_blks and leading to out-of-bounds bitmap_set() writes. A f...

CVE-2026-68131

The CVE-2026-68131 issue affects the Linux kernel RBD (block device) code. A bug in rbd_object_map_callback() could propagate a positive result code for an object-map update during a reply to an RBD request, which is invalid for writes. This prevents the intended normalization of the result code ...

EUVD-2026-55512

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

CVE-2026-68131 rbd: Reset positive result codes to zero in object map update path

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

EUVD-2026-55505

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

CVE-2026-68124

CVE-2026-68124 affects the Linux kernel MCTP serial driver. A zero-length frame could cause an out-of-bounds write in the receive path when rxlen == 0, requiring CAP_NET_ADMIN to attach the MCTP line discipline and bring up the netdev. The fix routes zero-length frames to STATE_TRAILER (instead o...

CVE-2026-68124 mctp: serial: handle zero-length frames to prevent rx buffer overflow

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

EUVD-2026-55487

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...