DEBIAN-CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

DEBIAN-CVE-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

DEBIAN-CVE-2026-98564

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

DEBIAN-CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

DEBIAN-CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

DEBIAN-CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

DEBIAN-CVE-2026-98617

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-numnapi; The issue is this is only correct in the cases where there are...

DEBIAN-CVE-2026-98567

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

DEBIAN-CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

DEBIAN-CVE-2026-98529

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

DEBIAN-CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

DEBIAN-CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

DEBIAN-CVE-2026-98533

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

DEBIAN-CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

DEBIAN-CVE-2026-98691

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Tear down inactive DP tunnels when the domain is stopped tbstop only tears down DMA tunnels so a DP tunnel that is still waiting for dprxwork to complete keeps that work queued while the routers are removed and the...

DEBIAN-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

DEBIAN-CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

DEBIAN-CVE-2026-98489

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

DEBIAN-CVE-2026-98667

In the Linux kernel, the following vulnerability has been resolved: iio: frequency: adf4377: Fully initialize clkinitdata and clkparentdata The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to...

DEBIAN-CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...