CVE-2026-98816

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98814

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98817

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

DEBIAN-CVE-2026-98805

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

DEBIAN-CVE-2026-98804

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...

DEBIAN-CVE-2026-98806

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

DEBIAN-CVE-2026-98807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

DEBIAN-CVE-2026-98808

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

DEBIAN-CVE-2026-98809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

AZL-109146 CVE-2026-98802 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

AZL-109074 CVE-2026-98808 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

AZL-108590 CVE-2026-98805 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

AZL-108714 CVE-2026-98809 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

DEBIAN-CVE-2026-98800

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

AZL-108939 CVE-2026-98803 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

DEBIAN-CVE-2026-98802

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

DEBIAN-CVE-2026-98801

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...