DEBIAN-CVE-2026-98692

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

DEBIAN-CVE-2026-98571

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmacrx, when napibuildskb fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect, but buf-page is left pointing at the...

DEBIAN-CVE-2026-98574

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

DEBIAN-CVE-2026-98614

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

DEBIAN-CVE-2026-98593

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

DEBIAN-CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

DEBIAN-CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

DEBIAN-CVE-2026-98699

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

DEBIAN-CVE-2026-98465

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

DEBIAN-CVE-2026-98588

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

DEBIAN-CVE-2026-98554

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlandevhardheader Callers that only reserve ETHHLEN or less such as llcallocframe, or skbs allocated before dynamic device/headroom changes e.g. toggling VLANFLAGREORDERHDR or bonding/team...

DEBIAN-CVE-2026-98678

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversamplingratio validation In ad4030setavgframelen, the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2. Validate that the...

DEBIAN-CVE-2026-98516

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

DEBIAN-CVE-2026-98530

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobesysctlmutex held, so...

DEBIAN-CVE-2026-98774

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

DEBIAN-CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

DEBIAN-CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

DEBIAN-CVE-2026-98617

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-numnapi; The issue is this is only correct in the cases where there are...

DEBIAN-CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

DEBIAN-CVE-2026-98567

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...