AZL-102938 CVE-2026-90370 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

CVE-2026-90370

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

DEBIAN-CVE-2026-90234

In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegation in an OPEN reply, nfsinodesetdelegation records it on the client. However, three of its error flows return without sending DELEGRETURN. A...

CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

DEBIAN-CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

AZL-102227 CVE-2026-90088 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90073

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

AZL-102557 CVE-2026-90073 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

CVE-2026-90053

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

DEBIAN-CVE-2026-90053

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

AZL-102324 CVE-2026-90053 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

SUSE CVE-2026-89796

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...

SUSE CVE-2026-89964

In the Linux kernel, the following vulnerability has been resolved: parisc: eisa: Fix infinite loop when parsing invalid IRQ value When an invalid value is passed via the "eisairqedge=" kernel command line parameter e.g. "eisairqedge=16,5", eisairqsetup prints an error message and continues witho...

Infinite loop

Overview exifreader is a Library that parses Exif metadata in images. Affected versions of this package are vulnerable to Infinite loop via a malformed ISO-BMFF iloc box in HEIC/AVIF files, parsed by parseItemLocationBox in src/image-header-iso-bmff-iloc.js. When the declared extentCount field in...

CVE-2026-93198

CVE-2026-93198 affects the Linux kernel component dm-pcache (device-mapper persistent cache). The writeback worker follows the persisted dirty_tail chain, which is decoded from the cache device independently of the key_tail chain that cache_replay() validates. Because on-media fields are authenti...

CVE-2026-93198 dm-pcache: validate the persisted dirty_tail chain at load

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate the persisted dirtytail chain at load The writeback worker follows the persisted dirtytail chain, which is decoded from the cache device independently of the keytail chain that cachereplay walks and bounds. A...

CVE-2026-93179

This vulnerability affects the Linux kernel in the drm/amd/powerplay subsystem. When the VBIOS supplies a malformed VoltageObjectInfo table, voltage objects whose usSize is smaller than the header or would advance the cursor past the table end are not rejected, causing either an infinite loop (ze...

EUVD-2026-82287

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

CVE-2026-93179 drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...