CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

AZL-100637 CVE-2026-89674 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

DEBIAN-CVE-2026-89678

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix partial-write detection in nfsddirectwrite nfsddirectwrite walks a list of write segments and, after each vfsiocbiterwrite, tries to detect a short write so the loop can stop before placing the next segment at a wrong...

DEBIAN-CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

AZL-100566 CVE-2026-89652 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

AZL-100506 CVE-2026-89656 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

DEBIAN-CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89653

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

DEBIAN-CVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

AZL-100418 CVE-2026-89653 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ceph: reject exporttargets ranks = CEPHMAXMDS in mdsmap decode MDSMap exporttargets entries are monitor controlled. checknewmap uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can...

CVE-2026-89656

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crushdecode stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket...

CVE-2026-89652

In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export getname cephgetname copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpyname, rinfo-dname, rinfo-dnamelen and then writes namerinfo-dnamelen = 0,...

AZL-100610 CVE-2026-89644 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map leak in NOCOW direct I/O write btrfsdioiomapbegin calls btrfsgetextent, which returns an extent map reference that must be dropped on all exit paths. For direct writes into a NOCOW range,...

CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

AZL-100625 CVE-2026-89615 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

AZL-100067 CVE-2026-89611 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...

DEBIAN-CVE-2026-89615

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound pagelcns index by the log record The copylcns loop and the redo shorten loop index pagelcns at j + i, where i runs up to the log record's lcnsfollow. That count is checked only against the record's own length, not...

DEBIAN-CVE-2026-89611

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate non-resident attribute offsets ntfsattrupdatemeta shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressedsize field before the name and...