DEBIAN-CVE-2026-98567

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

DEBIAN-CVE-2026-98568

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

DEBIAN-CVE-2026-98573

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

DEBIAN-CVE-2026-98517

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

DEBIAN-CVE-2026-98655

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

DEBIAN-CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

DEBIAN-CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

DEBIAN-CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

DEBIAN-CVE-2026-98525

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

DEBIAN-CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

DEBIAN-CVE-2026-98564

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

DEBIAN-CVE-2026-98666

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

DEBIAN-CVE-2026-98670

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

DEBIAN-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

DEBIAN-CVE-2026-98674

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Initialize state mutex The AXI ADC register access paths serialize transactions with st-lock, but probe does not initialize it. Initialize the mutex before registering the backend...

DEBIAN-CVE-2026-98861

In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guardrcuschednotrace and check rcuiswatching unregisterfprobe and unregisterfprobeasync used by BPF kprobe-multi rely on standard RCU grace periods synchronizercu and callrcu to wait until in-flight fprobe handlers...

DEBIAN-CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

DEBIAN-CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

DEBIAN-CVE-2026-98691

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

DEBIAN-CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...