DEBIAN-CVE-2026-68179

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

DEBIAN-CVE-2026-68178

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: pin the module while the device is open miscopen installs a misc driver's file operations with fopsget, which pins fileoperations::owner before replacing the file's fop. The NSM misc device leaves nsmdevfops.owner unse...

DEBIAN-CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

DEBIAN-CVE-2026-68173

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

DEBIAN-CVE-2026-68175

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

DEBIAN-CVE-2026-68170

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

DEBIAN-CVE-2026-68171

Bulletin has no description...

DEBIAN-CVE-2026-68168

In the Linux kernel, the following vulnerability has been resolved: afs: Fix afseditdirremove to get, not find, block 0 Fix afseditdirremove to use afsdirgetblock to get block 0 rather than afsdirfindblock as the latter caches the found block in the afsdiriter and may switch out the page it's on ...

DEBIAN-CVE-2026-68167

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not try compression for data reloc inodes BUG There is a syzbot report that the check inside getnewlocation triggered: BTRFS info device loop0: found 31 extents, stage: move data extents BTRFS info device loop0: leaf...

DEBIAN-CVE-2026-68166

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...

DEBIAN-CVE-2026-68169

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in getlocalid In mptcppmuserspacegetlocalid, the address entry is looked up under spinlock, but its id is read after dropping the lock. A concurrent deletion can free the entry between the...

DEBIAN-CVE-2026-68172

In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...

DEBIAN-CVE-2026-68158

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory accesses may occur in decodenewupstateweight. This happens because th...

DEBIAN-CVE-2026-68160

In the Linux kernel, the following vulnerability has been resolved: ceph: fix pre-auth out-of-bounds read on snaptrace in cephhandlecaps cephhandlecaps reads snaptracelen from the wire-format cephmdscaps header and uses it unconditionally to build a fake end pointer snaptrace + snaptracelen that ...

DEBIAN-CVE-2026-68159

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

DEBIAN-CVE-2026-68161

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

DEBIAN-CVE-2026-68163

In the Linux kernel, the following vulnerability has been resolved: mm/pagevmamapped: fix device-private PMD handling Commit 65edfda6f3f2 "mm/rmap: extend rmap and migration support device-private entries" introduced the concept of device-private PMD entries, but did not correctly update the rmap...

DEBIAN-CVE-2026-68152

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption. amtdevstop cancels reqwq and...

DEBIAN-CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

DEBIAN-CVE-2026-68150

In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of sumount dothawall iterates over all superblocks via iteratesupers with SUPERITEREXCL, which acquires sumount exclusively before calling the callback and releases it afterwards. Howeve...