DEBIAN-CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

UBUNTU-CVE-2026-89693

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

AZL-100217 CVE-2026-80949 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...

AZL-100657 CVE-2026-80948 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

UBUNTU-CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

CVE-2026-81016

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amdstbs2dinit discards the return value of several S2D SMU commands. When the SMU refuses a command e.g. "SMU cmd failed. err: 0xff" the failure is only noticed...

CVE-2026-89522

In the Linux kernel, the following vulnerability has been resolved: media: staging/ipu7: fix async notifier UAF on probe error path isysregisterdevices registers the V4L2 async notifier via isysnotifierinit. If a subsequent probe step such as isysfwloginit fails, isysprobe jumps to the outcleanup...

CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89462

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: propagate register read errors max17040getvcell and max17040getsoc ignore errors returned by regmapread. When an I2C transfer fails, the uninitialized register value is converted and reported to userspace...

CVE-2026-89563

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-80948

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...

CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

CVE-2026-89674

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to t...

CVE-2026-80993

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer. This can cause a kernel panic as...

CVE-2026-81004

In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed...

CVE-2026-89458

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Do not complete a failed ESE read as successful dasdinthandler completes an NRF read of an unallocated ESE track by calling eseread and unconditionally marking the request DASDCQRSUCCESS. dasdeckdeseread can return an...

CVE-2026-89454

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix IRQ domain leaks in the error paths of pldainitinterrupts pldainitinterrupts initializes IRQ domains and creates IRQ mapping but does not unwind them when later step fails. If platformgetirq or either...

CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...