DEBIAN-CVE-2026-98534

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

DEBIAN-CVE-2026-98560

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

DEBIAN-CVE-2026-98591

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

DEBIAN-CVE-2026-98650

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix potential races in dat skey functions When datcondsetstoragekey finds a large page, it will conditionally set the storage key in absolute memory using largecrstetophys to get the absolute address. There is a race...

DEBIAN-CVE-2026-98572

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

DEBIAN-CVE-2026-98510

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

DEBIAN-CVE-2026-98619

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

DEBIAN-CVE-2026-98577

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

DEBIAN-CVE-2026-98713

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

DEBIAN-CVE-2026-98470

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

DEBIAN-CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

DEBIAN-CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

DEBIAN-CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

DEBIAN-CVE-2026-98515

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

DEBIAN-CVE-2026-98835

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

DEBIAN-CVE-2026-98587

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...

DEBIAN-CVE-2026-98746

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

DEBIAN-CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush has published it. I...

DEBIAN-CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

DEBIAN-CVE-2026-98575

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...