DEBIAN-CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

DEBIAN-CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

DEBIAN-CVE-2026-98675

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: handle Phase C dip events in IRQ1 handler ADE9000ST1CROSSINGDEPTH is the exclusive upper bound for scanning the STATUS1 event bits, so a value of 25 left out the highest event bit, ADE9000ST1DIPCBIT bit 25. Pha...

DEBIAN-CVE-2026-98606

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

DEBIAN-CVE-2026-98461

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

DEBIAN-CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

DEBIAN-CVE-2026-98648

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

DEBIAN-CVE-2026-98475

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also a...

DEBIAN-CVE-2026-98658

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

DEBIAN-CVE-2026-98744

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

DEBIAN-CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

DEBIAN-CVE-2026-98534

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

DEBIAN-CVE-2026-98590

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

DEBIAN-CVE-2026-98818

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

DEBIAN-CVE-2026-98631

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

DEBIAN-CVE-2026-98646

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...

DEBIAN-CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

DEBIAN-CVE-2026-98644

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

DEBIAN-CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

DEBIAN-CVE-2026-98597

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The followi...