CVE-2026-89636

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in freetgts When freetgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cachedfstgt structures. If ce-tgthint is not reset before it is used later, it results in a...

CVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

CVE-2026-89641

In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfoput in cifsfilesetsize When the else branch of cifsfilesetsize finds a writable file handle via findwritablefile, it borrows tcon and server from the handle's tlink, attempts the handle-based...

CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

AZL-100335 CVE-2026-89622 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

DEBIAN-CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

CVE-2026-89625

In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind For GHL Guitar Hero Live dongles, sonyprobe arms a periodic timer: ghlmagicpoke the timer callback submits sc-ghlurb, and the URB completion ghlmagicpokecb re-arms the...

CVE-2026-89624

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...

CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

DEBIAN-CVE-2026-89623

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

AZL-100487 CVE-2026-89623 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89623

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hidhwstop Quiesce device IO at the start of the devm cleanup callback mcp2221hidunregister so that incoming HID reports cannot race with hardware teardown during probe failure or device removal...

CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

CVE-2026-89585

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: charlcd: cancel backlight work on registration failure With CONFIGCHARLCDBLFLASH, charlcdinit schedules blwork before charlcdregister calls miscregister. If registration fails, the caller frees the charlcd object whil...

CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89564

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

CVE-2026-89569

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: serialize security confirmation handling rfcommsecuritycfm looks up a session on sessionlist and then walks its DLC list without holding rfcommmutex. Since RFCOMM session teardown uses rfcommmutex, krfcommd can...

CVE-2026-89563

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-89555

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...