AZL-106236 CVE-2026-98289 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

DEBIAN-CVE-2026-98289

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

CVE-2026-98292

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

CVE-2026-98289

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

DEBIAN-CVE-2026-98294

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

DEBIAN-CVE-2026-98287

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

DEBIAN-CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

AZL-106371 CVE-2026-98284 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

DEBIAN-CVE-2026-98283

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

AZL-106359 CVE-2026-98283 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

AZL-106383 CVE-2026-98282 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

AZL-106047 CVE-2026-98286 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

DEBIAN-CVE-2026-98284

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

DEBIAN-CVE-2026-98282

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

DEBIAN-CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

AZL-106313 CVE-2026-98287 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

DEBIAN-CVE-2026-98285

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

AZL-106155 CVE-2026-98285 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98281

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...