AZL-108185 CVE-2026-98413 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

AZL-108180 CVE-2026-98416 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

DEBIAN-CVE-2026-98410

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left running by the driver sets WDOGHWRUNNING in da9063wdtprobe but userspac...

DEBIAN-CVE-2026-98414

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98409

In the Linux kernel, the following vulnerability has been resolved: watchdog: rtd119x: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-98410

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left running by the driver sets WDOGHWRUNNING in da9063wdtprobe but userspac...

CVE-2026-98413

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

CVE-2026-98415

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98411

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before initializing pwrseq-targets. pwrseqrelease will try to iterate over...

CVE-2026-98412

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrsequnitnew If memory allocation fails in pwrsequnitsetupdeps, pwrsequnitput is called to release the partially initialized unit. However, we've never initialized unit-list and...

CVE-2026-98414

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98416

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

DEBIAN-CVE-2026-98401

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

DEBIAN-CVE-2026-98400

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

AZL-108146 CVE-2026-98405 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

DEBIAN-CVE-2026-98403

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

AZL-108141 CVE-2026-98401 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

DEBIAN-CVE-2026-98408

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

AZL-108167 CVE-2026-98400 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

AZL-108102 CVE-2026-98403 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...