AZL-109154 CVE-2026-98697 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

AZL-108897 CVE-2026-98696 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

DEBIAN-CVE-2026-98696

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98696

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98697

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

CVE-2026-98698

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...

CVE-2026-98700

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee802118023xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211gettxrates uses the wron...

CVE-2026-98701

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98703

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98704

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

AZL-109016 CVE-2026-98695 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

CVE-2026-98688

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98690

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98692

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

AZL-108900 CVE-2026-98694 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

DEBIAN-CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-98691

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...