DEBIAN-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

UBUNTU-CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89682

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

AZL-100803 CVE-2026-89682 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89559

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...

DEBIAN-CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

AZL-100404 CVE-2026-89527 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

DEBIAN-CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

AZL-100073 CVE-2026-81003 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

DEBIAN-CVE-2026-80983

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-89559

In the Linux kernel, the following vulnerability has been resolved: libnvdimm/labels: Prevent integer overflow in ndlabelvalidate The on-media namespace index field nslot is a u32 read from the DIMM label storage area. ndlabelvalidate bounds it against the config area size, but sizeofnamespacelab...

CVE-2026-89682

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcachedisposal UAF by inlining dispose state into nfsdnet nfsdfiledisposelistdelayed defers fput to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

UBUNTU-CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

UBUNTU-CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

DEBIAN-CVE-2026-80929

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cadpid" entry from pidtable to kernreboottable cadpid is global, and killcadpid is only used in the root namespace. However, due to pidtablerootpermissions, a non-root user can unshare pid/user namespaces and...

CVE-2026-80929

In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cadpid" entry from pidtable to kernreboottable cadpid is global, and killcadpid is only used in the root namespace. However, due to pidtablerootpermissions, a non-root user can unshare pid/user namespaces and...