DEBIAN-CVE-2026-98549

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

DEBIAN-CVE-2026-98542

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98549

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

DEBIAN-CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

DEBIAN-CVE-2026-98548

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

AZL-108680 CVE-2026-98548 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

AZL-109181 CVE-2026-98549 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98547

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

AZL-108945 CVE-2026-98544 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

AZL-109089 CVE-2026-98535 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

AZL-108965 CVE-2026-98537 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

DEBIAN-CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98538

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98539

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

CVE-2026-98540

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

AZL-109007 CVE-2026-98539 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...