DEBIAN-CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

DEBIAN-CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

DEBIAN-CVE-2026-98691

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

DEBIAN-CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

DEBIAN-CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

DEBIAN-CVE-2026-98662

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap020a00f: drain irqwork after freeirq The threaded IRQ handler queues data-work through irqworkqueue so the trigger is polled from a per-CPU context. freeirq does not flush an irqwork the handler already queued, s...

DEBIAN-CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

DEBIAN-CVE-2026-98805

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

DEBIAN-CVE-2026-98760

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

DEBIAN-CVE-2026-98745

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...

DEBIAN-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

DEBIAN-CVE-2026-98529

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

DEBIAN-CVE-2026-98479

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

DEBIAN-CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

DEBIAN-CVE-2026-98533

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

DEBIAN-CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

DEBIAN-CVE-2026-98489

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

DEBIAN-CVE-2026-98705

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

DEBIAN-CVE-2026-98599

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

DEBIAN-CVE-2026-98551

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...