DEBIAN-CVE-2026-80745

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

DEBIAN-CVE-2026-80750

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

DEBIAN-CVE-2026-80751

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prevo in mtkmfgattachdev mtkmfgattachdev reads prevo on the first iteration of its loop, in "if prevo && prevo-freq == o-freq", before prevo is assigned at the end of the loop body. On that fir...

DEBIAN-CVE-2026-80752

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpadspisuspend retrieves the controller state with spigetdrvdata, but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe...

DEBIAN-CVE-2026-80749

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination a generic target, sized to accept many different data blocks...

DEBIAN-CVE-2026-80741

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drmlogdrawkmsgrecord accesses slen - 1 to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINTMAX, causing an out-of-bounds read...

DEBIAN-CVE-2026-80739

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case mlx5eaddfdbflow fails in lower levels, the flow is deleted via mlx5etcdelflow, and mlx5etcdelflow is acquiring ESW devcom lock without condition. In...

DEBIAN-CVE-2026-80744

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftablesoffload: suppress WARNONONCE for ENOMEM in abort path In nftflowruleoffloadabort, WARNONONCEerr is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under...

DEBIAN-CVE-2026-80742

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't send zero-byte data in tpacketsnd. syzbot reported a WARNING in devqueuexmit triggered via tpacketsnd: skbassertlen WARNING: at include/linux/skbuff.h:2753 skbassertlen WARNING: at devqueuexmit+0x21bc/0x4970...

DEBIAN-CVE-2026-80743

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: pass auddrvdata to irq handlers The irq handlers take a struct device pointer and call devgetdrvdata to obtain the driver data. However, the driver data is only set at the end of probe, after...

DEBIAN-CVE-2026-80740

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When scale is large enough that scaledfont exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in...

DEBIAN-CVE-2026-80738

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

DEBIAN-CVE-2026-80736

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAXGROUPS, while Group ID 0 is reserved. tbconsumeddpbandwidth uses the Group ID directly to index its local groupreserved array...

DEBIAN-CVE-2026-80735

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...

DEBIAN-CVE-2026-80733

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from skmcloop skmcloop can be called for sockets that are neither AFINET nor AFINET6 e.g. AFPACKET sockets when sending packets via raw/packet socket over virtual devices such as VRF or ipvlan. In such case...

DEBIAN-CVE-2026-80734

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

DEBIAN-CVE-2026-80737

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...

DEBIAN-CVE-2026-80728

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devresreleaseall unmaps the aperture before the DRM device release callback fires...

DEBIAN-CVE-2026-80730

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERRPTR to kthreadstop In testringbuffer's outfree cleanup loop, the check !rbthreadscpu only catches NULL entries and misses entries that hold an ERRPTR. rbthreads is static, so unassigned slots are...

DEBIAN-CVE-2026-80732

In the Linux kernel, the following vulnerability has been resolved: ata: patasl82c105: fix bridge revision use-after-free pcigetslot returns a referenced PCI device. Commit 44c10138fd4b "PCI: Change all drivers to use pcidevice-revision" replaced a configuration-space read with direct access to t...