DEBIAN-CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

DEBIAN-CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

DEBIAN-CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

AZL-106092 CVE-2026-98222 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98203

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

DEBIAN-CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

UBUNTU-CVE-2026-98317

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

UBUNTU-CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98348

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

UBUNTU-CVE-2026-98222

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

DEBIAN-CVE-2026-98177

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

AZL-106263 CVE-2026-98176 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...

AZL-106287 CVE-2026-98177 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

DEBIAN-CVE-2026-98176

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...