DEBIAN-CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89512

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

AZL-100595 CVE-2026-89512 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

DEBIAN-CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

AZL-100094 CVE-2026-89511 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

DEBIAN-CVE-2026-89512

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

DEBIAN-CVE-2026-89510

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89510

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

DEBIAN-CVE-2026-89513

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Fix PMU event info array size overflow SBI PMU EVENTGETINFO stores guest-controlled numevents sizeofeinfo in a 32-bit integer. On RV64, numevents = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one...

DEBIAN-CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

AZL-100115 CVE-2026-89510 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Cancel regwork before freeing device on remove c4iwuldstatechange queues regwork to register the RDMA device. c4iwremove can free ctx-dev while this work is pending or running, leaving c4iwregisterdevice accessing the...

CVE-2026-89507

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmawritecmevent ctx-file may only be changed under the handler lock and the xalock, which is what stops uevents being queued for a ctx while ucmamigrateid moves it to another file. The CM core take...

CVE-2026-89509

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...

CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89514

In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Use GFPATOMIC for VLAN alloc under spinlock fnicfcoeprocessvlanresp allocates a VLAN descriptor with kzallocobj default GFPKERNEL while holding vlanslock via spinlockirqsave. GFPKERNEL may sleep, which is not allowed ...

AZL-100187 CVE-2026-89504 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

DEBIAN-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

DEBIAN-CVE-2026-89500

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...