AZL-108933 CVE-2026-98839 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

AZL-109248 CVE-2026-98838 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

AZL-109056 CVE-2026-98840 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

DEBIAN-CVE-2026-98838

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

DEBIAN-CVE-2026-98846

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCVSHUTDOWN after the sendmsg connect wait sctpwaitforconnect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent...

DEBIAN-CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

DEBIAN-CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

CVE-2026-98842

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98845

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98844

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

DEBIAN-CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98838

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

CVE-2026-98846

In the Linux kernel, the following vulnerability has been resolved: sctp: check RCVSHUTDOWN after the sendmsg connect wait sctpwaitforconnect drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent...

CVE-2026-98840

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

DEBIAN-CVE-2026-98831

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

DEBIAN-CVE-2026-98830

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

DEBIAN-CVE-2026-98837

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...