355620 matches found
DEBIAN-CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
CVE-2026-99006
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...
CVE-2026-99010
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...
AZL-110846 CVE-2026-99006 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...
DEBIAN-CVE-2026-99006
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...
CVE-2026-99007
In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...
CVE-2026-99012
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...
CVE-2026-99008
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...
CVE-2026-99009
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...
DEBIAN-CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
AZL-110852 CVE-2026-99008 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...
CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
DEBIAN-CVE-2026-99007
In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...
DEBIAN-CVE-2026-99001
In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...
CVE-2026-98998
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...
DEBIAN-CVE-2026-99005
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...
CVE-2026-99002
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...
CVE-2026-99005
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...
DEBIAN-CVE-2026-98998
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...
CVE-2026-98999
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...