DEBIAN-CVE-2026-90399

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

CVE-2026-90399

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

CVE-2026-90398

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in macphycapsparse Currently, in ath11kwmitlvmacphycapsparse, kcalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct wmimacphycapabilities. The...

DEBIAN-CVE-2026-90398

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix stride mismatch in macphycapsparse Currently, in ath11kwmitlvmacphycapsparse, kcalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct wmimacphycapabilities. The...

AZL-102621 CVE-2026-90399 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix stride mismatch in macphycapsparse Currently, in ath12kwmimacphycapsparse, kzalloc sizes the macphycaps buffer as totphyid len, where len is clamped to minfirmwarelen, sizeofstruct ath12kwmimacphycapsparams. The...

AZL-102134 CVE-2026-90386 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

AZL-102785 CVE-2026-90374 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

CVE-2026-90341

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

AZL-101927 CVE-2026-90341 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

AZL-102906 CVE-2026-90322 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

AZL-102635 CVE-2026-90327 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

DEBIAN-CVE-2026-90327

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

AZL-101903 CVE-2026-90307 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

AZL-102245 CVE-2026-90295 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

CVE-2026-90246

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

DEBIAN-CVE-2026-90246

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

DEBIAN-CVE-2026-90230

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

AZL-102626 CVE-2026-90230 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

CVE-2026-90230

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

DEBIAN-CVE-2026-90223

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...