DEBIAN-CVE-2026-72276

In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefbprobe The memory allocated for pagerefs in fbdeferredioinit is not freed on the error path. Fix it by calling fbdeferrediocleanup...

DEBIAN-CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

DEBIAN-CVE-2026-72273

In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifbprobe Since commit 73ce73c30ba9 "fbdev: Transfer video= option strings to caller; clarify ownership" the string returned from fbgetoptions is expected to be freed by the caller, but the strin...

DEBIAN-CVE-2026-72269

In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafbprobe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafbvbeinit is not freed in some error paths. Fix this by updating the goto label...

DEBIAN-CVE-2026-72264

In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in subsequent error paths. Fix that by calling fbdestroymodelist...

DEBIAN-CVE-2026-72265

In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafbprobe In nvidiafbprobe, the memory allocated for modelist in nvidiasetfbinfo is not freed in the subsequent error paths. Fix that by calling fbdestroymodelist...

DEBIAN-CVE-2026-72253

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: validate skbdst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies o...

DEBIAN-CVE-2026-72252

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: don't leak bad clone into future transaction On memory allocation failure the cloned nftpipapomatch can enter a bad state: - some fields can have their lookup tables resized while others did not - bits...

DEBIAN-CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

DEBIAN-CVE-2026-72228

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primaryif leak on failed linearization If the skb has a fraglist, it must be linearized before it can be split using skbsplit. But when this step failed, it must not only free the skb but also take care of t...

DEBIAN-CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

DEBIAN-CVE-2026-72220

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a worker thread begins processing a new request and encounters an early...

DEBIAN-CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

DEBIAN-CVE-2026-72204

In the Linux kernel, the following vulnerability has been resolved: ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named index inodes. This keeps the root size and header geometry checks...

DEBIAN-CVE-2026-72211

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

DEBIAN-CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

DEBIAN-CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

DEBIAN-CVE-2026-72196

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetvcn tuple, the copylcns block walks lrh-lcnsfollow further entries: t16...

DEBIAN-CVE-2026-72197

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound DeleteIndexEntryAllocation memmove length In doaction's DeleteIndexEntryAllocation case, e-size comes from an on-disk INDEXBUFFER entry. When e-size makes e + e-size point past hdr + hdr-used, PtrOffsete1,...

DEBIAN-CVE-2026-72178

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: always put unsuccessfully committed target pids damoncommittarget puts and gets the destination and the source target pids. It puts the destination target pid because it will be overwritten by the source target pid...