USN-8903-2 linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oracle vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

USN-8903-2: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

USN-8905-2 linux-gcp vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

USN-8905-2: Linux kernel (GCP) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - MIPS architecture; - x86 architecture; - Intel NPU Driver; - Auxiliary...

K000163627: Linux kernel vulnerabilities CVE-2026-43276, CVE-2026-43329, CVE-2026-45898 and CVE-2026-46090

Security Advisory Description CVE-2026-43276 In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroyworkqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When...

K000163626: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-46242 In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix epremove struct eventpoll / struct file UAF epremove via epremovefile cleared file-fep under file-flock but then kept using @file inside the critical section isfileepoll...

CVE-2026-98287

A flaw was found in the Linux kernel's Point-to-Point Protocol over ATM PPPoATM subsystem. This vulnerability allows a local attacker to cause a Denial of Service DoS or memory corruption by transmitting network packets across bridged Point-to-Point Protocol PPP channels. The issue occurs because...

CVE-2026-98203

A flaw was found in the Linux kernel's SoC System on Chip button array driver. The driver fails to verify that the button descriptor package contains entries before accessing them during device initialization. This issue may allow an invalid device configuration to trigger an out-of-bounds memory...

K000163623: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-46113 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN The shadow MMU computes GFNs for direct shadow pages using sp-gfn plus the SPTE index. This assumption breaks for shado...

DEBIAN-CVE-2026-98381

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

AZL-106908 CVE-2026-98380 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

AZL-106910 CVE-2026-98381 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

AZL-106917 CVE-2026-98379 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

DEBIAN-CVE-2026-98384

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

AZL-106914 CVE-2026-98384 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

DEBIAN-CVE-2026-98378

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpflinkprime inserts a link into linkidr before anoninodegetfile succeeds and before bpflinksettle publishes the ID in link-id. bpflinkbyid treats such an ID-zero link as unsettled, but...

DEBIAN-CVE-2026-98380

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

DEBIAN-CVE-2026-98382

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

DEBIAN-CVE-2026-98379

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

AZL-106902 CVE-2026-98382 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...