PT-2026-94755

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath11k wmi process csa switch count event function. This happens because there is no policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

PT-2026-94756

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read can occur in the ath12k wmi process csa switch count event function. This is caused by the absence of a policy entry for WMI TAG PDEV CSA SWITCH COUNT STATUS EVENT,...

PT-2026-94901

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the esp ssg unref function where it incorrectly releases page references on the source scatterlist after an AEAD operation. When a socket buffer skb contains managed...

PT-2026-94932

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device reference count leak exists during MHI device creation. The function mhi ep create device allocates references for the UL and DL channels; however, if dev set name or device add...

PT-2026-94939

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ipu7 resume function within the staging media ipu7 component. The issue arises because pm runtime get sync is called before resuming the device; if t...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from netfilter nftables’ double cloning of set expression elements during element insertion. This may lead to an imbalance in the reference count of the connlimit expression module and trigger warnings...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

DEBIAN-CVE-2026-89936

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

AZL-101481 CVE-2026-89936 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: dac: m62332: Fix regulator reference count imbalance m62332setvalue enables the Vcc regulator on every write of a non-zero value and disables it on every write of zero, without tracking the channel's current state. Because t...

CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

DEBIAN-CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

CVE-2026-89858

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00updatefruversions qla2x00updatefruversions copies the user-supplied BSG request into a fixed 256-byte stack buffer bsgDMAPOOLSIZE and then iterates list-count times over the...

CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

DEBIAN-CVE-2026-89841

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-89830

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...

DEBIAN-CVE-2026-89830

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix valid block count leak on data block allocation failure In allocatedatablock, when allocating a new data block dn-datablkaddr == NULLADDR, incvalidblockcount is called first to increment totalvalidblockcount and iblocks...

EUVD-2026-80554

In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image information block inside the current erase block, then uses the image information regioncount to walk entries from a fixed local array. Th...

CVE-2026-89947 clk: meson: align gxbb_32k_clk_sel number of parents with actual count

In the Linux kernel, the following vulnerability has been resolved: clk: meson: align gxbb32kclksel number of parents with actual count The following out-of-bounds read has been observed by Christian on a GXBB WeTek Hub: ================================================================== BUG: KASA...

CVE-2026-89947

CVE-2026-89947 is a global-out-of-bounds read in the Linux kernel's Amlogic Meson GXBB clock driver . When commit 7915d7d5407c removed a non-existing 32k clock parent from the gxbb_32k_clk_sel mux, it did not adjust the hard-coded num_parents field, causing __clk_register to read past the end of ...