DEBIAN-CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

DEBIAN-CVE-2026-98540

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

DEBIAN-CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

DEBIAN-CVE-2026-98500

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

DEBIAN-CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

DEBIAN-CVE-2026-98495

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

DEBIAN-CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

DEBIAN-CVE-2026-98553

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

DEBIAN-CVE-2026-98642

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

DEBIAN-CVE-2026-98535

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

DEBIAN-CVE-2026-98559

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

DEBIAN-CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

DEBIAN-CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

DEBIAN-CVE-2026-98526

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

DEBIAN-CVE-2026-98462

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

DEBIAN-CVE-2026-98538

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

DEBIAN-CVE-2026-98624

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...

DEBIAN-CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

DEBIAN-CVE-2026-98625

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

DEBIAN-CVE-2026-98488

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...