CVE-2026-92505

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...

AZL-101867 CVE-2026-92477 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufssavederrwrite copies user input into a zero-initialized stack buffer and passes it to kstrtoint. A write that fills the entire buffer overwrites its only terminator...

AZL-103044 CVE-2026-90416 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90416

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

AZL-102623 CVE-2026-90219 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

CVE-2026-90219

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

DEBIAN-CVE-2026-90219

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

AZL-102368 CVE-2026-90209 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ echo .../vmur/level $ rmmod vmur...

CVE-2026-90209

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ echo .../vmur/level $ rmmod vmur...

DEBIAN-CVE-2026-90209

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ echo .../vmur/level $ rmmod vmur...

EUVD-2026-82171

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93061

CVE-2026-93061 is a stack over-read in the Linux kernel's host1x GPU driver . The functions host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed to the output callbac...

CVE-2026-93061 gpu: host1x: Avoid stack over-read in debug output helpers

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

CVE-2026-93049

CVE-2026-93049 is a double-free vulnerability in the Linux kernel's mtdswap module. In mtdswap_add_mtd(), when debugfs setup fails after a successful blktrans registration, the code calls del_mtd_blktrans_dev() (which frees the blktrans device via blktrans_dev_release()), then falls through to a ...

CVE-2026-93049 mtd: mtdswap: Avoid freeing registered blktrans device twice

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

EUVD-2026-82159

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

CVE-2026-93049 mtd: mtdswap: Avoid freeing registered blktrans device twice

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

CVE-2026-92505

CVE-2026-92505 addresses an undefined behavior bug in the Linux kernel's iommu/amd module, specifically in the devid_write debugfs function. The root cause is that when for_each_pci_segment() completes without finding a matching segment, the pci_seg pointer is left pointing to an invalid memory l...

CVE-2026-92505 iommu/amd: Fix undefined behavior in devid_write debugfs function

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix undefined behavior in devidwrite debugfs function When foreachpcisegment loop completes without finding a matching segment, the pciseg pointer is not NULL but points to an invalid memory location the list head...