DEBIAN-CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

DEBIAN-CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

DEBIAN-CVE-2026-98658

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

DEBIAN-CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

DEBIAN-CVE-2026-98744

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

DEBIAN-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

DEBIAN-CVE-2026-98514

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validateinit On the ttmboreserve failure and "vma not found" error paths, the loop breaks without adding the looked-up object to any validate list, so the reference taken by drmgemobjectlook...

DEBIAN-CVE-2026-98461

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

DEBIAN-CVE-2026-98475

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also a...

DEBIAN-CVE-2026-98482

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

DEBIAN-CVE-2026-98606

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

DEBIAN-CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

DEBIAN-CVE-2026-98595

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

DEBIAN-CVE-2026-98607

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

DEBIAN-CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

DEBIAN-CVE-2026-98675

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000ST1CROSSINGDEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000ST1DIPCBIT bit 25. Pha...

DEBIAN-CVE-2026-98648

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

DEBIAN-CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

DEBIAN-CVE-2026-98621

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

DEBIAN-CVE-2026-98631

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...