DEBIAN-CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

AZL-100676 CVE-2026-89520 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

DEBIAN-CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

DEBIAN-CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

DEBIAN-CVE-2026-89501

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

DEBIAN-CVE-2026-89491

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin Patch series "ocfs2: cluster: o2hbregionpin fixes", v2. This series fixes three related issues in o2hbregionpin, all are from the original implementation in...

DEBIAN-CVE-2026-89484

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

AZL-100265 CVE-2026-89491 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin Patch series "ocfs2: cluster: o2hbregionpin fixes", v2. This series fixes three related issues in o2hbregionpin, all are from the original implementation in...

CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80954

In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev-desc in i3cdevicegetsupportedxfermode i3cdevicegetsupportedxfermode uses dev-desc to obtain the master controller. However, dev-desc must not be dereferenced unless bus-lock is held, and this...

DEBIAN-CVE-2026-80953

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

UBUNTU-CVE-2026-89662

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown destroyclient releases a client's open owners, but a lock owner whose only reference is a blocked lock nbl stays on clownerstrhashtbl. clienthasstate does not count a...

UBUNTU-CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

CVE-2026-89520

In the Linux kernel, the following vulnerability has been resolved: sched/core: Make core-sched flips wait for in-flight selections Core scheduling's picknexttask operates on all sibling rqs under one acquisition of the shared core-wide lock. A -picktask that releases the rq lock leaves every...

CVE-2026-89655

In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in kickflushingcaps on cf entry freed during unlock listforeachentry iterates ci-icapflushlist but drops icephlock to send cap messages. During the unlock window, handlecapflushack can acquire icephlock, detach cf...

UBUNTU-CVE-2026-89609

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfsexorcisedaemon drops queued messages from a dying daemon without holding ecryptfsmsgctxlistsmux, but ecryptfsmsgctxalloctofree requires that lock. Take the list...

CVE-2026-89521

In the Linux kernel, the following vulnerability has been resolved: sched/core: Handle picktask releasing the rq lock Core scheduling's picknexttask breaks when a -picktask implementation can release the rq lock. The selection state derived on entry is only valid while the lock is held...

UBUNTU-CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

CVE-2026-89567

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...