CVE-2026-90124

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

DEBIAN-CVE-2026-90124

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-rzg2l: Fix loss of interrupt rzg2lclearirqint and rzg2lcleartintint perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are...

DEBIAN-CVE-2026-90116

In the Linux kernel, the following vulnerability has been resolved: ALSA: mtpav: shut down output timer before card teardown sndmtpavoutputtimer rearms chip-timer while holding chip-spinlock and accesses the card-private mtpav state. sndmtpavfree currently takes the same lock and calls timerdelet...

CVE-2026-90092

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

DEBIAN-CVE-2026-90092

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

AZL-102993 CVE-2026-90092 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90091

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-92514

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

DEBIAN-CVE-2026-90091

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

CVE-2026-90084

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

CVE-2026-90081

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

AZL-102960 CVE-2026-90084 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

AZL-102839 CVE-2026-90081 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

DEBIAN-CVE-2026-90081

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

DEBIAN-CVE-2026-90084

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

CVE-2026-54575

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

EUVD-2026-82327

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

SUSE CVE-2026-89823

In the Linux kernel, the following vulnerability has been resolved: drm: fix race between partial drmdevregister failure and ioctl If drmdevregister fails after registering a minor e.g. render minor registered, primary minor fails, userspace could have opened the first minor and entered a...

SUSE CVE-2026-89844

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Hold vportslock for host map update in report ID acquisition qla24xxreportidacquisition format-1 handling drops vportslock after taking the vport reference and then calls qlaupdatehostmap without the lock. That...

SUSE CVE-2026-89855

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize flash version read in reset handler The "update cache versions without reset" sysfs reset operation 0x20261 calls getflashversion, which reads hardware flash registers, without holding ha-optrommutex. The...