355579 matches found
CVE-2026-99041
In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...
AZL-110915 CVE-2026-99040 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...
DEBIAN-CVE-2026-99038
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...
AZL-110921 CVE-2026-99043 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...
DEBIAN-CVE-2026-99039
In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...
CVE-2026-99043
In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...
AZL-110903 CVE-2026-99036 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...
DEBIAN-CVE-2026-99034
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...
DEBIAN-CVE-2026-99033
In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packetrcvspkt packetrcvspkt restores the link layer header with skbpushskb, skb-data - skbmacheaderskb; That subtraction is only meaningful when the device actually has a link layer header...
AZL-110894 CVE-2026-99033 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packetrcvspkt packetrcvspkt restores the link layer header with skbpushskb, skb-data - skbmacheaderskb; That subtraction is only meaningful when the device actually has a link layer header...
AZL-110906 CVE-2026-99037 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...
CVE-2026-99037
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...
CVE-2026-99033
In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packetrcvspkt packetrcvspkt restores the link layer header with skbpushskb, skb-data - skbmacheaderskb; That subtraction is only meaningful when the device actually has a link layer header...
CVE-2026-99036
In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...
AZL-110897 CVE-2026-99034 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...
DEBIAN-CVE-2026-99032
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...
DEBIAN-CVE-2026-99031
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...
AZL-110900 CVE-2026-99035 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...
CVE-2026-99031
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...
CVE-2026-99032
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...