CVE-2026-98873

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

AZL-110596 CVE-2026-98873 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: zero at allocation time There are occasional LLM hints wrt. leaking uninitialized data to userspace via ctnetlink. Just zero at allocation time, expectations are not frequently used these days...

CVE-2026-98874

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

DEBIAN-CVE-2026-98874

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

CVE-2026-98870

In the Linux kernel, the following vulnerability has been resolved: ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only while conn-binding is still set: if conn-binding...

CVE-2026-98899

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98900

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98883

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...

CVE-2026-98892

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98888

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

CVE-2026-98874

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

CVE-2026-98879

In the Linux kernel, the following vulnerability has been resolved: isofs: handle setblocksize failures isofs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98895

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98901

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

CVE-2026-98882

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98906

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

CVE-2026-98871

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

CVE-2026-98880

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98898

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...

CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...