DEBIAN-CVE-2026-98354

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

DEBIAN-CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

DEBIAN-CVE-2026-98352

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget, before the peer is connected. createcm can return -ERESTARTSYS from...

DEBIAN-CVE-2026-98353

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

AZL-106188 CVE-2026-98351 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98350

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out authstatus on initialization. Otherwise, garbage will leak from the stack to the firmware when ssid is less than 32 bytes and/or when params-pmkid is set. Then, pass...

CVE-2026-98353

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

CVE-2026-98354

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

CVE-2026-98352

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget, before the peer is connected. createcm can return -ERESTARTSYS from...

CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

AZL-106290 CVE-2026-98354 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

DEBIAN-CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

AZL-106302 CVE-2026-98349 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

AZL-106194 CVE-2026-98353 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

DEBIAN-CVE-2026-98347

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

DEBIAN-CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

DEBIAN-CVE-2026-98344

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

AZL-105990 CVE-2026-98345 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

DEBIAN-CVE-2026-98346

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...