DEBIAN-CVE-2026-74676

In the Linux kernel, the following vulnerability has been resolved: vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl enforce, allowing a process to change meta mode on a non-controlling...

DEBIAN-CVE-2026-74675

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...

DEBIAN-CVE-2026-74677

In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...

DEBIAN-CVE-2026-74673

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where...

DEBIAN-CVE-2026-74672

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

DEBIAN-CVE-2026-74678

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179178a: fix skb leak in ax88179txfixup When the interface has NETIFFSG enabled and skblinearize fails in ax88179txfixup, the function returns NULL without freeing the skb. usbnetstartxmit treats a NULL return from...

DEBIAN-CVE-2026-74674

In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...

DEBIAN-CVE-2026-74671

In the Linux kernel, the following vulnerability has been resolved: ima: fix out-of-bounds read in xattrverify The digest-length check in xattrverify mixes int and sizet: if xattrlen - sizeofxattrvalue-type - hashstart = iint-imahash-length sizeof yields sizet, so the usual arithmetic conversions...

DEBIAN-CVE-2026-74663

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

DEBIAN-CVE-2026-74669

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvsinicmp rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmpsend. However, IPCBskb-opt still describes the outer IPv4...

DEBIAN-CVE-2026-74668

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in TXRING send path tpacketsnd reads dev-hardheaderlen independently for skb allocation and header construction in tpacketfillskb. Concurrent netdevice reconfiguration can therefore make the...

DEBIAN-CVE-2026-74670

In the Linux kernel, the following vulnerability has been resolved: ipvs: stop estimator after disabled calc phase IPVS estimator kthread 0 starts with zeroed chain and tick limits until its initial calculation phase completes. If network namespace teardown clears ipvs-enable during that phase,...

DEBIAN-CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

DEBIAN-CVE-2026-74664

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

DEBIAN-CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

DEBIAN-CVE-2026-74667

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

DEBIAN-CVE-2026-74658

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

DEBIAN-CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

DEBIAN-CVE-2026-74659

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire brmrpalloctestskb builds MRP test frames on an skb from devallocskb, which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is append...

DEBIAN-CVE-2026-74657

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fibnlmsgsize for RTAVIA nexthops fibnlmsgsize still estimates nexthop space as if every gateway is encoded as an IPv4 RTAGATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fibnexthopinfo dumps as RTAVI...