CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68766 – irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
https://notcve.org/view.php?id=CVE-2025-68766
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twocell() sets "hwirq" to >= MCHP_EIC_NIRQ (2) then it results in an out of bounds access. The code checks for invalid values, but doesn't set the error code. Return -EINVAL in that case, instead of returning success. In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_... • https://git.kernel.org/stable/c/00fa3461c86dd289b441d4d5a6bb236064bd207b •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68765 – mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()
https://notcve.org/view.php?id=CVE-2025-68765
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add(), an skb sskb is allocated. If the subsequent call to mt76_connac_mcu_alloc_wtbl_req() fails, the function returns an error without freeing sskb, leading to a memory leak. Fix this by calling dev_kfree_skb() on sskb in the error handling path to ensure it is properly released. In the Linux kernel, the following vulnerability has been resolved: mt76: mt761... • https://git.kernel.org/stable/c/99c457d902cf90bdc0df5d57e6156ec108711068 •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68764 – NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags
https://notcve.org/view.php?id=CVE-2025-68764
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the "ro" flag. In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem is being automounted, it needs to preserve the user-set superblock mount options, such as the... • https://git.kernel.org/stable/c/f2aedb713c284429987dc66c7aaf38decfc8da2a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2025-68763 – crypto: starfive - Correctly handle return of sg_nents_for_len
https://notcve.org/view.php?id=CVE-2025-68763
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nents_for_len was assigned to an unsigned long in starfive_hash_digest, causing negative error codes to be converted to large positive integers. Add error checking for sg_nents_for_len and return immediately on failure to prevent potential buffer overflows. In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly han... • https://git.kernel.org/stable/c/7883d1b28a2b0e62edcacea22de6b36a1918b15a •
CVSS: 6.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68759 – wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()
https://notcve.org/view.php?id=CVE-2025-68759
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ring(), memory is allocated for skb packets and DMA allocations in a loop. When an allocation fails, the previously successful allocations are not freed on exit. Fix that by jumping to err_free_rings label on error, which calls rtl8180_free_rx_ring() to free the allocations. Remove the free of rx_ring in rtl8180_init_rx_ring() error path, and set the free... • https://git.kernel.org/stable/c/f653211197f3841f383fa9757ef8ce182c6cf627 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68758 – backlight: led-bl: Add devlink to supplier LEDs
https://notcve.org/view.php?id=CVE-2025-68758
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED class devices, but devlink is currently unable to create correct supplier-producer links when the supplier is a class device. It creates instead a link where the supplier is the parent of the expected device. One consequence is that removal order is not correctly enforced. Issues happen for example with the following sections in a device tree ... • https://git.kernel.org/stable/c/ae232e45acf9621f2c96b41ca3af006ac7552c33 •
CVSS: 5.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68757 – drm/vgem-fence: Fix potential deadlock on release
https://notcve.org/view.php?id=CVE-2025-68757
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests sy... • https://git.kernel.org/stable/c/4077798484459a2eced2050045099a466ecb618a •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2025-68756 – block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
https://notcve.org/view.php?id=CVE-2025-68756
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset. Initially a tagset starts as unshared and when the number of added queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along with all the queues attach... • https://git.kernel.org/stable/c/98d81f0df70ce6fc48517d938026e3c684b9051a •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-68755 – staging: most: remove broken i2c driver
https://notcve.org/view.php?id=CVE-2025-68755
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging. Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to pro... • https://git.kernel.org/stable/c/723de0f9171eeb49a3ae98cae82ebbbb992b3a7c •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2025-68753 – ALSA: firewire-motu: add bounds check in put_user loop for DSP events
https://notcve.org/view.php?id=CVE-2025-68753
05 Jan 2026 — In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event handling code, a put_user() loop copies event data. When the user buffer size is not aligned to 4 bytes, it could overwrite beyond the buffer boundary. Fix by adding a bounds check before put_user(). In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event ha... • https://git.kernel.org/stable/c/634ec0b2906efd46f6f57977e172aa3470aca432 •