DEBIAN-CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

DEBIAN-CVE-2026-80657

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer The management mailbox channel cleanup helpers can be called from error handling paths when mgmtchann has already been destroyed. Add NULL checks to...

DEBIAN-CVE-2026-80651

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp/sev-dev-tsm - bail out early when pdev-bus is NULL dsmcreate initially checks pdev-bus when computing segmentid: u8 segmentid = pdev-bus ? pcidomainnrpdev-bus : 0; But the next two lines unconditionally dereference...

DEBIAN-CVE-2026-80653

In the Linux kernel, the following vulnerability has been resolved: scsi: hisisas: Add slavedestroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at...

DEBIAN-CVE-2026-80649

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix OOB in scmipowernameget scmipowernameget does not validate the domain number passed by the external caller, which may lead to an out-of-bounds access. Fix this by returning "unknown" for invalid domains, li...

DEBIAN-CVE-2026-80641

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: enable the right set of ciphers The firmware version number check for IGTK introduced in commit c34dbc5900b0 "wifi: wlcore: Add support for IGTK key" lets the amount of ciphers decrease on every boot of a too old...

DEBIAN-CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

DEBIAN-CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

DEBIAN-CVE-2026-80643

In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Fix call trace due to missing release When unloading the igen6edac driver, there is a call trace: Device 'null' does not have a release function, it is broken and must be fixed. See Documentation/core-api/kobject.rst...

DEBIAN-CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

DEBIAN-CVE-2026-80647

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by iballoccq always have a comphandler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the...

DEBIAN-CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

DEBIAN-CVE-2026-80638

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

DEBIAN-CVE-2026-80633

In the Linux kernel, the following vulnerability has been resolved: iommufd: Take dmaresv lock before dmabufunpin in release path dmabufunpin requires the caller to hold the exporter's dmaresv lock: void dmabufunpinstruct dmabufattachment attach ... dmaresvasserthelddmabuf-resv;...

DEBIAN-CVE-2026-80640

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix fortifypanic Fix a runtime assertion in cxlctlgetsupportedfeatures. Fortify complains that it is potentially overflowing the entries array per countedbylenumentries. Quiet the false positive by initializing...

DEBIAN-CVE-2026-80635

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

DEBIAN-CVE-2026-80637

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and putunalignedbe32 to safely read and write the timestamp fields. This prevents performance degradation due to unaligned memory acces...

DEBIAN-CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

DEBIAN-CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

DEBIAN-CVE-2026-80634

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid numencaps underflow on bridge VLAN untag The DEVPATHBRVLANUNTAG case post-decrements info-numencaps inside WARNONONCE. numencaps is u8, so if it's already 0 the decrement still happens and wraps it to...