kernel

Vulnerabilities (14,119)

• CVE-2026-68308Aug 10, 2026
  affected >= 6.2.0, < 6.6.148fixed 6.6.148

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it.

• CVE-2026-68307Aug 10, 2026
  affected >= 6.11.0, < 6.12.101fixed 6.12.101

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925_vif_connect_iter() replays firmware state for links tracked in mvif->valid_links. After MLO link changes or MCU timeout recovery,

• CVE-2026-68306Aug 10, 2026
  affected >= 6.3.0, < 6.6.148fixed 6.6.148

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() mt76_connac_get_eht_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it.

• CVE-2026-68305HigAug 10, 2026
  affected >= 6.18.0, < 7.1.6fixed 7.1.6

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM stru

• CVE-2026-68304Aug 10, 2026
  affected >= 4.13.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpa_auth as 1x_256 mode, need to set up "use_fwsup" with BRCMF_PROFILE_FWSUP_1X. Or it will happen trace warning when call brcmf_cfg80211_set_pmk().

• CVE-2026-68303Aug 10, 2026
  affected >= 4.4.0, < 7.1.6fixed 7.1.6

  In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use dev_get_drvdata(master) in their unbind functions. Since the vc4-drm gets removed before its dependent drivers (vc4_hvs/vc4_v3d) the

• CVE-2026-68302CriAug 10, 2026
  affected >= 5.16.0, < 6.1.183fixed 6.1.183

  In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that

• CVE-2026-68301Aug 10, 2026
  affected < 5.15.216fixed 5.15.216

  In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which propagates VID 0 to its slave devices (slave A

• CVE-2026-68300CriAug 10, 2026
  affected >= 2.6.24, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. sk

• CVE-2026-68299HigAug 10, 2026
  affected >= 4.2.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them

• CVE-2026-68298HigAug 10, 2026
  affected >= 6.18.0, < 6.18.42fixed 6.18.42

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() Commit 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") made xe_svm_init() unconditional in xe_vm_create() and extended it to also

• CVE-2026-68297HigAug 10, 2026
  affected >= 4.18.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPC_NL_MEDIA_SET and TIPC_NL_BEARER_SET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets th

• CVE-2026-68296Aug 10, 2026
  affected >= 6.12.0, < 6.12.101fixed 6.12.101

  In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before commit 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx"), NETIF_F_LLTX was set unconditionally in both __gre_tunnel_init() an

• CVE-2026-68295HigAug 10, 2026
  affected >= 6.7.0, < 7.1.6fixed 7.1.6

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BP

• CVE-2026-68294HigAug 10, 2026
  affected >= 4.7.0, < 5.10.265fixed 5.10.265

  In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_local_nid is a sing

• CVE-2026-68293HigAug 10, 2026
  affected >= 5.18.0, < 6.12.101fixed 6.12.101

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords (128 bytes) when the device advertises the mcia_32dwords capability, but struct mlx5_ifc_mcia_reg_bits

• CVE-2026-68292Aug 10, 2026
  affected >= 6.18.0, < 6.18.42fixed 6.18.42

  In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf->txtime_txqs bitmap tracks which Tx queues have ETF (Earliest TxTime First) offload enabled. This bitmap is indexed by queue number and is set by

• CVE-2026-68291Aug 10, 2026
  affected >= 6.7.0, < 7.1.6fixed 7.1.6

  In the Linux kernel, the following vulnerability has been resolved: idpf: fix max_vport related crash on allocation error during init Set adapter->max_vports only after successful allocation of vports, netdevs and vport_config buffers. This fixes possible crashes on reset or r

• CVE-2026-68290HigAug 10, 2026
  affected < 6.12.101fixed 6.12.101

  In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp

• CVE-2026-68289Aug 10, 2026
  affected >= 4.12.0, < 7.1.6fixed 7.1.6

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In tipc_recvmsg(), the copy length is computed as: copy = min_t(int, dlen - offset, buflen); buflen is size_t but min_t(int, ...) casts it