DEBIAN-CVE-2026-68355

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix potential buffer underflow in ath11khalrxmsdulistget When the first entry in msdudetails has a zero buffer address, the code accesses msdudetailsi - 1 with i == 0, causing a buffer underflow. Fix similarly to...

DEBIAN-CVE-2026-68353

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware nummsg in TX complete handler The firmware-controlled nummsg field u8, 0-255 drives the loop in ath6klwmitxcompleteeventrx without validation against the buffer length. This allows...

DEBIAN-CVE-2026-68354

In the Linux kernel, the following vulnerability has been resolved: firewire: net: Fix fragmented datagram reassembly fwnetfragnew keeps a sorted list of received fragments for a partial datagram. When a new fragment is adjacent to an existing fragment, the code checks whether the new fragment al...

DEBIAN-CVE-2026-68352

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

DEBIAN-CVE-2026-68349

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rxstream failover path The failover continuation in carl9170rxstream copies the full tlen from the second USB transfer instead of capping at rxfailovermissing bytes. When both transfers are...

DEBIAN-CVE-2026-68347

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix IRQ unsafe locking in gdom allocation Lockdep complains: 259.410489 ===================================================== 259.417287 WARNING: HARDIRQ-safe - HARDIRQ-unsafe lock order detected 259.424667...

DEBIAN-CVE-2026-68348

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen before checking that the string terminator is present inside the firmware blob. A...

DEBIAN-CVE-2026-68350

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix OOB read from off-by-two in TX status handler The bounds check in carl9170txprocessstatus uses i cmd-hdr.len / 2 + 1 which is off by two, allowing 2 extra iterations past valid txstatus entries when the...

DEBIAN-CVE-2026-68346

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the...

DEBIAN-CVE-2026-68345

In the Linux kernel, the following vulnerability has been resolved: armmpam: guard MBWU state before adding it to garbage destroycomponentcfg adds each RIS mbwustate object to the MPAM garbage list when destroying component configuration. However, mbwustate is allocated per RIS and only for RISes...

DEBIAN-CVE-2026-68338

In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packetsetring temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po-num, unregisters the...

DEBIAN-CVE-2026-68342

In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpnpeerreleasep2p is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket...

DEBIAN-CVE-2026-68343

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parsedfsreferrals validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a...

DEBIAN-CVE-2026-68341

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via ovpnpeerput. If this drops the last reference, the peer is eventually...

DEBIAN-CVE-2026-68337

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

DEBIAN-CVE-2026-68344

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect ueaprobe distinguishes a pre-firmware device from a post-firmware one using the USB id UEAISPREFIRM, and stores a different object as the interface data i...

DEBIAN-CVE-2026-68335

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdsfindbound looks up the destination socket using a global rhashtable keyed solely on addr, port, scopeid. Network namespaces are not part of the key, so a send...

DEBIAN-CVE-2026-68334

In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix iothread race in rxrpcwakeupiothread rxrpcwakeupiothread checks local-iothread before waking it, but then reloads the pointer for wakeupprocess. local-iothread is cleared with WRITEONCE when the I/O thread exits, so th...

DEBIAN-CVE-2026-68332

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix potential use-after-free in airohappedeinit airohappedeinit replaces the NPU pointer with NULL via rcureplacepointer but does not wait for existing RCU readers to exit before calling ppedeinit and airohanpuput...

DEBIAN-CVE-2026-68329

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Wait for completion instead of returning early in iommucompletionwait needsync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and clear...