DEBIAN-CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

DEBIAN-CVE-2026-64156

In the Linux kernel, the following vulnerability has been resolved: netfs, afs: Fix write skipping in dir/link writepages Fix netfswritesingle and afssinglewritepages to better handle a write that would be skipped due to lock contention and WBSYNCNONE by returning 1 from netfswritesingle if it...

DEBIAN-CVE-2026-64159

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix zeropoint update where isize remoteisize Fix the update of the zero point by netfsreleasefolio when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio ie...

DEBIAN-CVE-2026-64158

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix write streaming disablement if fd open ORDWR In netfsperformwrite, "write streaming" the caching of dirty data in dirty but !uptodate folios is performed to avoid the need to read data that is just going to get...

DEBIAN-CVE-2026-64148

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...

DEBIAN-CVE-2026-64142

In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against mfplist lookups ksmbddurablescavenger has two related races against any walker that iterates fci-mfplist, including ksmbdlookupfdinode used by ksmbdvfsrename and the share-mode checks ...

DEBIAN-CVE-2026-64150

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftinner: release locallock before re-enabling softirqs Quoting sashiko: In the error path, localbhenable is called before localunlocknestedbh...

DEBIAN-CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

DEBIAN-CVE-2026-64143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: uniwill-laptop: Do not enable the charging limit even when forced It seems that on some older models 2020 the battery charging limit can permanently damage the battery. Prevent users from enabling this feature thru...

CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

DEBIAN-CVE-2026-64135

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 widen blackbox-info buffer to I2CSMBUSBLOCKMAX adm1266nvmemreadblackbox declares a 5-byte stack buffer and passes it to i2csmbusreadblockdata to retrieve the 4-byte BLACKBOXINFO response. i2csmbusreadblockdat...

DEBIAN-CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

DEBIAN-CVE-2026-64133

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache findcontrol to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it...

DEBIAN-CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

DEBIAN-CVE-2026-64127

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: ecredreconfigure: send packed pdu, not stack pointer Commit 1c08108f3014 "Bluetooth: L2CAP: Avoid -Wflex-array-member-not-at-end warnings" converted the on-stack request PDU in l2capecredreconfigure from an...

DEBIAN-CVE-2026-64116

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6hopioam Reported by Sashiko: The function ipv6hopioam accesses in6devgetskb-dev-cnf.ioam6enabled without validating the returned idev pointer. Because addrconfifdown can concurrently cle...

DEBIAN-CVE-2026-64118

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously allocated CID bitmaps before returning an error. qedcxttablesalloc...

DEBIAN-CVE-2026-64121

In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over numtxqueues ifbdevinit allocates dp-txprivate to dev-numtxqueues entries via kzallocobjstxp, dev-numtxqueues. Both IFB per-queue RX and TX stats live in those entries: ifbxmit updates txp-rxsta...

DEBIAN-CVE-2026-64120

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix NULL pointer dereference in phyreplysize In phypreparedata, several strings such as 'name', 'drvname', 'upstreamsfpname', and 'downstreamsfpname' are allocated using kstrdup. However, these allocations were not...

DEBIAN-CVE-2026-64111

In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...