EUVD-2026-81814

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90221 nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90122 clk: visconti: Make sure clk_init_data is fully initialized

In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-90122 clk: visconti: Make sure clk_init_data is fully initialized

In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-90104

CVE-2026-90104 affects the Linux kernel's NFSv4.1 callback handling. In decode_cb_sequence_args(), the csa_rclists array is allocated with kmalloc_objs(), leaving referring_call_list entries uninitialized. Because decode_rc_list() only assigns rcl_refcalls when the list is non-empty, a valid empt...

CVE-2026-92052

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component...

CVE-2026-90221: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

CVE-2026-90300: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in bpfgettaskstack Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path...

CVE-2026-90428: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...

CVE-2026-84639

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used...

CVE-2026-89859

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

DEBIAN-CVE-2026-89859

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak qla2x00dodportdiagnostics allocates the qladportdiag response buffer with kmallocobj non-zeroing and, on success, copies the full sizeofdd back to user space via...

AZL-101573 CVE-2026-89852 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

CVE-2026-89852

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...

DEBIAN-CVE-2026-89794

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

AZL-101355 CVE-2026-89794 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

CVE-2026-89794 ksmbd: zero pipe read compound padding

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

EUVD-2026-80394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero pipe read compound padding Compound response handling extends the last response iov to an eight-byte boundary. smb2readpipe allocates only the payload size, so the alignment padding can expose up to seven bytes of...

CVE-2026-89852: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Zero mailbox struct in qla2x00getfirmwarestate The mbxcmdt is allocated on the stack but left uninitialized. qla2x00mailboxcommand has several early-return paths PCI permanent failure, device failed, EEH busy, ISP...