DEBIAN-CVE-2026-64005

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

DEBIAN-CVE-2026-64007

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

DEBIAN-CVE-2026-64003

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues While a SCSI host is in a recovery state, scsimqrequeuecmd will not set the requeue list for a requeued command to be kicked in the future. The expectation...

DEBIAN-CVE-2026-63997

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors moduleflashfwschedule is missing undo for setting the "inprogress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we a...

DEBIAN-CVE-2026-63996

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

DEBIAN-CVE-2026-63989

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 "bridge: bridge port parameters over netlink", brsetport was always called with...

DEBIAN-CVE-2026-63987

In the Linux kernel, the following vulnerability has been resolved: ethtool: coalesce: cap profile updates at NETDIMPARAMSNUMPROFILES ethnlupdateprofile walks the ETHTOOLAPROFILEIRQMODERATION nest list with an index 'i' and writes newprofilei++ without bounding i. The destination is kmemdup'd at...

DEBIAN-CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

DEBIAN-CVE-2026-63976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

DEBIAN-CVE-2026-63975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

DEBIAN-CVE-2026-63970

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtiotransportsendpktinfo allocates or reuses the zerocopy uarg before entering the send loop, but virtiotransportallocskb still fills the skb before it inherits that uarg. Whe...

DEBIAN-CVE-2026-63961

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

DEBIAN-CVE-2026-63968

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6selectpath Found while auditing the same pattern Sashiko reported in rt6fillnode 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers...

DEBIAN-CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

DEBIAN-CVE-2026-63939

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

DEBIAN-CVE-2026-63942

In the Linux kernel, the following vulnerability has been resolved: parport: Fix race between port and client registration The parport subsystem registers port devices before they are fully initialised, resulting in a race condition where client drivers such as lp can attach to ports that are not...

DEBIAN-CVE-2026-63936

In the Linux kernel, the following vulnerability has been resolved: iio: adc: mt6359: fix unchecked return value in mt6358readimp In mt6358readimp, the variable valv is passed to regmapread but the return value is not checked. If the read fails, valv remains uninitialized and its random stack...

DEBIAN-CVE-2026-63937

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Use READONCE when reading entries/indices from PSC buffer Use READONCE when reading entries/indices from the guest-accessible Page State Change buffer to defend against TOCTOU bugs. Don't bother with READONCE/WRITEONCE...

DEBIAN-CVE-2026-63933

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16260: fix division by zero in writeraw Add a validation check for the sampling frequency value before using it as a divisor. A user writing zero to the samplingfrequency sysfs attribute triggers a division by zero...

DEBIAN-CVE-2026-63928

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...