CVE-2026-98309

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

CVE-2026-98310

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98311

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98313

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

DEBIAN-CVE-2026-98304

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

AZL-106227 CVE-2026-98307 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

AZL-106167 CVE-2026-98303 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

AZL-106335 CVE-2026-98302 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

AZL-106266 CVE-2026-98301 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

AZL-106386 CVE-2026-98304 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

DEBIAN-CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

DEBIAN-CVE-2026-98302

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

DEBIAN-CVE-2026-98307

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

DEBIAN-CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

DEBIAN-CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98303

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98302

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...