AZL-104675 CVE-2026-98115 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

AZL-104595 CVE-2026-98094 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

DEBIAN-CVE-2026-98094

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

CVE-2026-98060

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

DEBIAN-CVE-2026-98060

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

AZL-104193 CVE-2026-98023 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

DEBIAN-CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

AZL-104865 CVE-2026-98009 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-97971

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

DEBIAN-CVE-2026-97909

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

AZL-104580 CVE-2026-97909 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

AZL-104832 CVE-2026-97613 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...

DEBIAN-CVE-2026-97613

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...

DEBIAN-CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

CVE-2026-97524

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcpdataready via state change under unlucky error conditions, and then try to hold the data lock again. Break the...

CVE-2026-98115

The Linux kernel contains a vulnerability in ksmbd regarding the handling of SMB3 multichannel requests. The issue arises because shared session objects may be freed before all bound channels are processed. Additionally, a deferred byte-range lock can remain counted as a running request, waking o...

EUVD-2026-86946

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-98094

The Linux kernel contains a vulnerability in the fbtft driver where dirty_lock is not IRQ-safe. Specifically, fbtft_mkdirty() can be reached from the fbcon rendering path during hardirq context, while fbtft_deferred_io() takes the same lock in a workqueue context with local interrupts enabled. Th...

CVE-2026-98094 staging: fbtft: make dirty_lock IRQ-safe

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...