DEBIAN-CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

AZL-104462 CVE-2026-97565 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

AZL-104187 CVE-2026-97560 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

AZL-104279 CVE-2026-97563 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

DEBIAN-CVE-2026-97563

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

DEBIAN-CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

DEBIAN-CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

DEBIAN-CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

AZL-104634 CVE-2026-97529 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

UBUNTU-CVE-2026-98136

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...

UBUNTU-CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

UBUNTU-CVE-2026-98077

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

UBUNTU-CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

UBUNTU-CVE-2026-97930

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

UBUNTU-CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

UBUNTU-CVE-2026-98123

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...