DEBIAN-CVE-2026-98194

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

DEBIAN-CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

AZL-106218 CVE-2026-98192 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

DEBIAN-CVE-2026-98195

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98194

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98195

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

DEBIAN-CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

AZL-106116 CVE-2026-98180 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98260

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98243

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98256

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

UBUNTU-CVE-2026-98320

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

UBUNTU-CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

UBUNTU-CVE-2026-98196

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcmsfreetimer brcmsfreetimer calls brcmsdeltimer which uses the non-synchronous canceldelayedwork to cancel the timer's underlying delayed work. If the work callback brcmstimer is already running,...

CVE-2026-98253

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

CVE-2026-98368

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98266

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it synchronizes with the whole release procedure. However, when the card is...