CVE-2026-98293

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

AZL-106050 CVE-2026-98292 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

DEBIAN-CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

AZL-106401 CVE-2026-98293 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

DEBIAN-CVE-2026-98293

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in isoconnready isogetsock returns the parent socket with a reference held, which is dropped by sockput once the child socket has been set up. The error path taken when isosockalloc fails on...

DEBIAN-CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

DEBIAN-CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

AZL-106371 CVE-2026-98284 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

DEBIAN-CVE-2026-98283

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

AZL-106383 CVE-2026-98282 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

AZL-106047 CVE-2026-98286 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

DEBIAN-CVE-2026-98284

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

DEBIAN-CVE-2026-98282

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

DEBIAN-CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

AZL-106313 CVE-2026-98287 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

AZL-106359 CVE-2026-98283 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

CVE-2026-98284

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...