RLSA-2026:71585 Important: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks...

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled

Summary With $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Details The iframe...

BIT-OPENBAO-2026-55776 OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/ could terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. The Transit policy...

RLSA-2026:71586 Important: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks...

AZL-104813 CVE-2026-98154 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

DEBIAN-CVE-2026-98154

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

CVE-2026-98154

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

CVE-2026-98106

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

DEBIAN-CVE-2026-98106

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

AZL-104322 CVE-2026-98066 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

DEBIAN-CVE-2026-98066

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

CVE-2026-98066

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

AZL-104172 CVE-2026-97978 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

DEBIAN-CVE-2026-97978

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97978

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

AZL-104658 CVE-2026-97599 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsimupdatepib does an unserialized read-swap-free of phy-pib: pibold = rtnldereferencephy-pib; ... rcuassignpointerphy-pib, pib; kfreercupibold, rcu; It assumes the RTN...

DEBIAN-CVE-2026-97599

In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsimupdatepib does an unserialized read-swap-free of phy-pib: pibold = rtnldereferencephy-pib; ... rcuassignpointerphy-pib, pib; kfreercupibold, rcu; It assumes the RTN...

CVE-2026-97599

In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsimupdatepib does an unserialized read-swap-free of phy-pib: pibold = rtnldereferencephy-pib; ... rcuassignpointerphy-pib, pib; kfreercupibold, rcu; It assumes the RTN...

CVE-2026-97589

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When cryptofinalizehashrequest or cryptofinalizeskcipherrequest explicitly completes a request, the doonerequest callback must return 0 to indicate successful...

DEBIAN-CVE-2026-97589

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When cryptofinalizehashrequest or cryptofinalizeskcipherrequest explicitly completes a request, the doonerequest callback must return 0 to indicate successful...