CVE-2026-68368

A flaw was found in the Linux kernel's USB gadget NCM Network Control Model driver. This vulnerability occurs because the driver fails to properly validate the boundaries of datagrams and Network Transfer Blocks NTBs supplied by a USB host. A malicious USB host can exploit this by crafting specif...

CVE-2026-68247

A flaw was found in the Linux kernel's drm/i915/bios component. This component, responsible for display-related operations, failed to perform a necessary range check on the paneltype2 field within the LFP Data Block. This oversight could result in the selection of an incorrect panel type,...

CVE-2026-68249

A flaw was found in the Linux kernel's drm/amdgpu/sdma5.0 component. This issue occurs when certain conditions trigger a BUGON macro, which is designed to halt system execution upon detecting a critical error. A local attacker could exploit this to cause a kernel crash, leading to a denial of...

CVE-2026-68240

A flaw was found in the Linux kernel's drm/gpusvm component. When drmgpusvmgetpages encounters an error during page mapping, it fails to properly unmap previously created device mappings. This oversight can lead to a device mapping leak, consuming system resources and potentially impacting system...

CVE-2026-68401

A flaw was found in the ARM Firmware Framework for Arm FFA driver within the Linux kernel. This vulnerability, specifically in the ffasetupandtransmit function, allows for out-of-bounds writes due to incorrect size handling when writing to memory descriptors and constituents. An attacker could...

CVE-2026-68215

A flaw was found in the Linux kernel's radio-si476x media driver. During the device probing process, if certain initialization steps fail, the v4l2device may not be properly unregistered. This oversight can lead to a resource leak, specifically a persistent parent device reference. A local attack...

CVE-2026-68161

A flaw was found in the Linux kernel's SCTP Stream Control Transmission Protocol implementation. When a network namespace netns is torn down, the associated SCTP UDP User Datagram Protocol tunnel sockets are not properly closed. This oversight can lead to a resource leak, potentially resulting in...

CVE-2026-68175

A flaw was found in the Linux kernel's mmiotrace tracer. A local user could repeatedly read from the tracepipe file without fully completing the read operation. This improper handling of resource cleanup leads to a significant memory leak and leaves stale references. The continuous accumulation o...

CVE-2026-68387

A flaw was found in the Linux kernel's Controller Area Network CAN raw socket implementation. A local attacker could exploit a race condition in the rawsetsockopt function. This occurs due to insufficient locking during read-modify-write operations on a shared bitfield when modifying socket flags...

CVE-2026-68423

A flaw was found in the Linux kernel's mtd: virtconcat subsystem. The mtdvirtconcatdestroy function incorrectly calls mtdvirtconcatputmtddevices after mtdconcatdestroy has already freed the associated memory. This use-after-free vulnerability can lead to system instability or potentially enable a...

CVE-2026-68190

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. The rtwgetwpsie function, responsible for processing network frame data, fails to properly validate the size of incoming information elements IEs. This oversight allows an attacker to trigger an out-of-bounds read, potentially leading...

CVE-2026-68235

A flaw was found in the Linux kernel's AMD display drm/amd/display driver. This vulnerability occurs when handling DisplayPort Multi-Stream Transport MST for DCE8-class ASICs, where the system may incorrectly assign an analog encoder that lacks necessary DisplayPort functions. This misassignment...

CVE-2026-68204

A flaw was found in the Linux kernel's media subsystem, specifically within the vivid driver. The vividupdateformatcap/out functions, which handle video format changes, can be called when the video buffer queue is actively processing data. This occurs because checks for a busy queue are missing...

CVE-2026-68335

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS component. The RDS component incorrectly handles incoming messages that cross network namespace boundaries, allowing a sender in one network namespace to deliver a message to a socket in a different network namespace. This can...

CVE-2026-68331

A flaw was found in the Linux kernel's dpaa2-eth component. When a network device connects and then disconnects, a reference to the MAC endpoint device is not properly released. This oversight causes a resource leak with each successful connection and subsequent disconnection. Repeated exploitati...

CVE-2026-68289

A flaw was found in the Linux kernel. An integer overflow vulnerability exists within the Transparent Inter-Process Communication TIPC subsystem, specifically in the tipcrecvmsg and tipcrecvstream functions. This issue occurs when a buffer length value exceeds the maximum integer size, leading to...

CVE-2026-68176

A flaw was found in the Linux kernel's mmiotrace component. When mmiopipeopen fails to find a PCI device, a null pointer is assigned to hiter-dev. The mmiotrace read function then attempts to dereference this null pointer, which can lead to a system crash and result in a denial of service. A loca...

CVE-2026-68202

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

CVE-2026-68407

A flaw was found in the Linux kernel's Wi-Fi subsystem nl80211. When processing beacon frames, the nl80211parsebeacon function may fail to properly free allocated RNR Reduced Neighbor Report data if there is a mismatch in the number of RNR and MBSSID Multiple Basic Service Set Identifier entries...

CVE-2026-68404

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. This vulnerability involves a race condition during the process of disconnecting a wireless device, where a work item can be improperly queued after it has been cancelled. This could allow a local attacker to trigger a system...

CVE-2026-68367

A flaw was found in the Linux kernel's USB gadget function ftcm. A local attacker could exploit a race condition during the teardown of a USB gadget function. This could lead to a use-after-free vulnerability, potentially causing a system crash denial of service or, in more severe cases, arbitrar...

CVE-2026-68272

A flaw was found in the Linux kernel's drm/amdgpu component. An unprivileged local attacker can exploit this vulnerability by submitting a specially crafted command with a zero-length chunk size for CPGFXSHADOW. This leads to improper memory access within the kernel, causing a system crash and a...

CVE-2026-68178

A flaw was found in the Linux kernel's NSM Network Shared Memory misc device. A local user could exploit this by opening the /dev/nsm device and then unloading the NSM module. This allows a subsequent operation ioctl on the open file descriptor to call into memory that has been deallocated,...

CVE-2026-68254

A flaw was found in the Linux kernel's drm/i915/vrr component. An attacker could provide a specially crafted Extended Display Identification Data EDID with a zero minimum vertical refresh rate minvfreq. This could lead to a division-by-zero error in the intelvrrcomputevmax function, resulting in ...

CVE-2026-68233

A flaw was found in the drm/vc4 component of the Linux kernel. A logic error in the BO cache timer shutdown process allows the timer to be rearmed even after it has been destroyed. This can lead to work being queued again after teardown, potentially causing system instability or a denial of servi...

CVE-2026-68214

A flaw was found in the Linux kernel's media: rtl2832 driver. A timing issue during the removal of the rtl2832 device can lead to a use-after-free vulnerability. This occurs when the system attempts to access memory that has already been released, which can cause system instability or a denial of...

CVE-2026-68222

A flaw was found in the Linux kernel's msi2500 media driver. This vulnerability occurs when the startstreaming function fails to properly return queued buffers, causing them to leak. An attacker with local access could potentially exploit this to cause system instability or a denial of service Do...

CVE-2026-68372

A flaw was found in the Linux kernel's USB Type-C port handling. A local user, by unplugging a Thunderbolt dock, can trigger a race condition during the device teardown process. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been...

CVE-2026-70639

A flaw was found in llama.cpp. A null pointer dereference vulnerability exists in the LLaMA-Android JNI wrapper. This flaw allows an attacker to provide a malicious or corrupt model file, which causes the bench1model function to attempt to use an invalid memory address. This leads to a crash of t...

CVE-2026-68238

A flaw was found in the drm/amdgpu component of the Linux kernel. The amdgpuacpivfctbios function fails to release a reference to the VFCT ACPI table after fetching it. This oversight leads to a resource leak, where memory allocated for the table mapping is not properly freed, potentially impacti...

CVE-2026-68210

A flaw was found in the Linux kernel's media: stm32: dcmi driver. When the dcmigraphinit function fails to initialize due to issues with resetcontrolassert or resetcontroldeassert, an asynchronous notifier is not properly unregistered. This oversight can lead to resource leaks, potentially causin...

CVE-2026-68270

A flaw was found in the Linux kernel's drm/sysfb component. This flaw occurs when calculating the visible size of the system framebuffer. The calculation uses 32-bit arithmetic, which can overflow if the values for height and stride are excessively large. This overflow leads to truncation of the...

CVE-2026-68356

A flaw was found in the Linux kernel's airoha watchdog driver. This vulnerability occurs when the clock frequency is zero, causing the driver to attempt a division by zero. This can lead to a system crash, resulting in a denial of service for the affected system...

CVE-2026-68300

A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...

CVE-2026-68317

A flaw was found in the Linux kernel's pdscore component. A race condition exists during the addition and deletion of auxiliary devices, where concurrent operations can lead to a resource leak or a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash,...

CVE-2026-68412

A flaw was found in the Linux kernel's Wi-Fi subsystem, specifically within the cfg80211 component. This vulnerability, located in the cfg80211wextsiwscan function, can lead to a memory leak. A local attacker could exploit this by sending a crafted Wi-Fi scan request with an Extended Service Set...

CVE-2026-68375

A flaw was found in the Linux kernel's bnxten driver, which handles Broadcom NetXtreme-C/E network adapters. The bnxtauxdevicesinit function calls auxiliarydeviceinit before all required fields for the release callback are fully initialized. If a memory allocation fails after auxiliarydeviceinit...

CVE-2026-68323

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication module. A race condition exists in the handling of UDP bearer replicast list updates. This can occur when tipcudprcastadd and cleanupbearer functions attempt to update the list concurrently without proper...

CVE-2026-68304

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. When the driver operates in 802.1X-SHA256 authentication mode, it fails to correctly configure a firmware-related setting. This misconfiguration can trigger a kernel call trace warning during the execution of the brcmfcfg80211setpmk...

CVE-2026-68250

A flaw was found in the drm/amdgpu/sdma5.2 component of the Linux kernel. A local attacker could potentially trigger a condition that would previously lead to a kernel panic due to a BUGON macro. This vulnerability could result in a system-wide Denial of Service DoS, making the system unresponsiv...

CVE-2026-68350

A flaw was found in the Linux kernel's carl9170 Wi-Fi driver. An out-of-bounds read vulnerability exists within the carl9170txprocessstatus function. This issue is caused by an off-by-two error in a bounds check, allowing the system to read beyond the intended memory buffer when processing...

CVE-2026-68342

A flaw was found in the Linux kernel's OpenVPN ovpn module. During the destruction of an ovpn UDP socket, a race condition can occur where a new peer is published before the old socket is fully released. This can lead to a use-after-free vulnerability, allowing an attacker to potentially cause a...

CVE-2026-68398

A flaw was found in the Linux kernel's Point-to-Point Protocol PPP over L2TP Layer 2 Tunneling Protocol implementation. An unprivileged user can exploit a Use-After-Free UAF vulnerability, where the system attempts to use memory after it has been freed. This can lead to memory corruption,...

CVE-2026-68290

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP implementation. A race condition can occur during network namespace teardown, where a concurrent system control sysctl write operation attempts to access a socket that has already been freed. This use-after-free vulnerabilit...

CVE-2026-68402

A flaw was found in the Linux kernel's Wi-Fi subsystem cfg80211. The cfg80211iselementinherited function does not properly validate the length of extension elements. A remote attacker, by sending a specially crafted Wi-Fi frame from an Access Point AP, could trigger a one-octet slab-out-of-bounds...

CVE-2026-68373

A flaw was found in the Linux kernel's at76c50x-usb Wi-Fi driver. A remote attacker could exploit a length underflow vulnerability in the at76guessfreq function by sending a specially crafted Wi-Fi frame. This can cause an out-of-bounds read during the scanning process, potentially leading to a...

CVE-2026-68341

A flaw was found in the Linux kernel's ovpn module. When the unlockovpn function processes a list of objects, it may attempt to access memory that has already been freed. This use-after-free vulnerability could potentially lead to system instability or, in more severe cases, arbitrary code...

CVE-2026-68188

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

CVE-2026-68194

A flaw was found in the Linux kernel's mt76 WiFi driver. When the driver processes a TXRXNOTIFY event on non-Memory-Mapped I/O MMIO buses, such as USB or SDIO, it attempts to call a null function pointer. This can lead to a kernel NULL pointer dereference, causing a system crash and resulting in ...

CVE-2026-68198

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. A use-after-free vulnerability exists within the aggrresetstate function. This occurs because a non-synchronous timer deletion allows a timer callback aggrtimeout to access memory that has already been freed, creating a race condition. A...