CVE-2026-98412

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrsequnitnew If memory allocation fails in pwrsequnitsetupdeps, pwrsequnitput is called to release the partially initialized unit. However, we've never initialized unit-list and...

CVE-2026-98411

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before initializing pwrseq-targets. pwrseqrelease will try to iterate over...

CVE-2026-98410

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left running by the driver sets WDOGHWRUNNING in da9063wdtprobe but userspac...

CVE-2026-98415

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

DEBIAN-CVE-2026-98403

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

AZL-108167 CVE-2026-98400 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

DEBIAN-CVE-2026-98400

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

AZL-108102 CVE-2026-98403 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

AZL-108135 CVE-2026-98406 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...

DEBIAN-CVE-2026-98408

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

DEBIAN-CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

AZL-108159 CVE-2026-98404 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...

DEBIAN-CVE-2026-98401

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

AZL-108141 CVE-2026-98401 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

AZL-108116 CVE-2026-98407 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

DEBIAN-CVE-2026-98406

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...

AZL-108113 CVE-2026-98402 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmpsend tracepoint syzbot reported a WARNING triggered by DEBUGNETWARNONONCE: WARNING: at skbtransportheader include/linux/skbuff.h:3087 inline WARNING: at udphdr...

DEBIAN-CVE-2026-98402

In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmpsend tracepoint syzbot reported a WARNING triggered by DEBUGNETWARNONONCE: WARNING: at skbtransportheader include/linux/skbuff.h:3087 inline WARNING: at udphdr...

AZL-108146 CVE-2026-98405 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

DEBIAN-CVE-2026-98404

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...