DEBIAN-CVE-2026-90303

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

CVE-2026-90303

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

AZL-101873 CVE-2026-90303 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

DEBIAN-CVE-2026-90269

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

DEBIAN-CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

AZL-102291 CVE-2026-90264 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

DEBIAN-CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

DEBIAN-CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

AZL-102546 CVE-2026-90083 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actife: Only operate on Ethernet frames actife encapsulates/decapsulates the original Ethernet header and uses skb-dev-hardheaderlen as the length of that header. That is only correct for Ethernet devices: on a device...

CVE-2026-90059

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NETIPALIGN in the RX DMA offset Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the...

SUSE CVE-2026-89828

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix init ordering in amdgpuvrammgrinit drmmcgroupregisterregion is called before INITLISTHEAD and gpubuddyinit in amdgpuvrammgrinit. If it fails, the function returns early and bypasses those initializations. Since...

SUSE CVE-2026-89887

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

SUSE CVE-2026-89966

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

EUVD-2026-82243

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-93135

CVE-2026-93135 is a vulnerability in the Linux kernel BPF subsystem affecting architectures that implement bpf_jit_inlines_helper_call() (e.g., LoongArch, ARM64, RISC-V ). When the verifier skips rewriting the helper call offset (insn->imm) because it expects the JIT to inline the helper, the ...

EUVD-2026-82121

In the Linux kernel, the following vulnerability has been resolved: ext4: use fsdata to track inline data write state and fix race Instead of checking the live inode state ext4hasinlinedatainode and ext4testinodestateinode, EXT4STATEMAYINLINEDATA in the writeend handlers, use the fsdata parameter...