AZL-100193 CVE-2026-89598 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

DEBIAN-CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

UBUNTU-CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

UBUNTU-CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-80999

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

UBUNTU-CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

AZL-100286 CVE-2026-80931 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

DEBIAN-CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

UBUNTU-CVE-2026-80931

In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...

CVE-2026-89622

CVE-2026-89622 is a write use-after-free in the Linux kernel's HID mcp2221 driver . The function mcp_i2c_smbus_read() stores a caller-supplied buffer pointer in mcp->rxbuf but fails to clear it when an I2C/SMBus transfer completes or times out. Once the caller frees the buffer, a delayed or sp...

CVE-2026-89622 HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

EUVD-2026-76534

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-89622 HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...