CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

AZL-104247 CVE-2026-97961 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: perf/core: Allow listdel during perfeventoverflow A PMU might use perfschedcbinc and perfschedcbdec interface to get the PMU call back function pmu::schedtask invoked at schedule in and schedule out. This is achieved by walking...

CVE-2026-97956

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...

DEBIAN-CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

DEBIAN-CVE-2026-97956

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...

AZL-104360 CVE-2026-97960 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drainpebs reentry The PEBS buffer is shared by all events on a CPU, so drainpebs must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most...

CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97957

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

DEBIAN-CVE-2026-97948

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

CVE-2026-97948

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

CVE-2026-97951

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target core sets CMDTABORTED and waits for the frontend to finish processing. ...

CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

DEBIAN-CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

AZL-104570 CVE-2026-97950 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...

CVE-2026-97941

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

DEBIAN-CVE-2026-97943

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

CVE-2026-97937

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

CVE-2026-97943

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

CVE-2026-97940

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

DEBIAN-CVE-2026-97932

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed. Keep the...