DEBIAN-CVE-2026-68427

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1xboclearcachedmappings host1xbounpin drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cach...

DEBIAN-CVE-2026-68425

In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, aft...

DEBIAN-CVE-2026-68422

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in mergerelocroots If we have an unexpected relocroot for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missi...

DEBIAN-CVE-2026-68428

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmudestroycaches destroys ptelistdesccache and mmupageheadercache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor modu...

DEBIAN-CVE-2026-68423

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroy mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat after that leads to a use-after-free. Fix it by moving mtdvirtconcatputmtddevices...

DEBIAN-CVE-2026-68424

In the Linux kernel, the following vulnerability has been resolved: mtd: virtconcat: fix use-after-free in mtdvirtconcatdestroyjoins mtdconcatdestroy frees item-concat so calling mtdvirtconcatputmtddevicesitem-concat leads to a use after free. Fix this by moving mtdvirtconcatputmtddevices before...

DEBIAN-CVE-2026-68426

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-prev after async crypto steals a GSO segment skbgsosegment leaves the segment list head with -prev pointing at the last segment, an invariant validatexmitskblist relies on when it sets its tail pointer tail =...

DEBIAN-CVE-2026-68421

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't warn on core-sched forced idle in putprevtaskscx putprevtaskscx warns when a runnable task drops to a lower schedclass without SCXOPSENQLAST, on the assumption that balanceone would have kept it running. Core...

DEBIAN-CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

DEBIAN-CVE-2026-68417

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

DEBIAN-CVE-2026-68413

In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100pciinitone The memory allocated in the ipw2100allocdevice function is not freed in some of the error paths in ipw2100pciinitone. Fix that by converting the direct return into a...

DEBIAN-CVE-2026-68414

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

DEBIAN-CVE-2026-68410

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helperfirmwarecb helperfirmwarecb neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak...

DEBIAN-CVE-2026-68412

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

DEBIAN-CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

DEBIAN-CVE-2026-68405

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs disabled. It then calls ieee80211freetxskb before dropping the lock...

DEBIAN-CVE-2026-68408

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsrfreewk to wiphywork to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211releasepmsr clears the request's nlportid and queues pmsrfreewk to call cfg80211pmsrprocessabort...

DEBIAN-CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

DEBIAN-CVE-2026-68403

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: initialize SDIO data work before cleanup brcmfsdioprobe stores the newly allocated bus in sdiodev-bus before allocating the ordered workqueue. If that allocation fails, the function jumps to fail and calls...

DEBIAN-CVE-2026-68400

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...