AZL-108984 CVE-2026-98761 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

AZL-109044 CVE-2026-98754 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

AZL-108803 CVE-2026-98756 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

AZL-108936 CVE-2026-98757 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

AZL-108614 CVE-2026-98758 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98759

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

DEBIAN-CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98760

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

CVE-2026-98757

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

CVE-2026-98761

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

CVE-2026-98754

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

CVE-2026-98755

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

AZL-109137 CVE-2026-98747 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

AZL-109419 CVE-2026-98748 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

DEBIAN-CVE-2026-98749

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

DEBIAN-CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

AZL-108788 CVE-2026-98749 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...