DEBIAN-CVE-2026-99181

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

AZL-111311 CVE-2026-99166 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

DEBIAN-CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

DEBIAN-CVE-2026-99172

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

DEBIAN-CVE-2026-99170

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree leaves out can't take over a lock Since commit c62a4766937e "movemount: transfer MNTLOCKED" a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which...

CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

CVE-2026-99170

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree leaves out can't take over a lock Since commit c62a4766937e "movemount: transfer MNTLOCKED" a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which...

DEBIAN-CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

AZL-111320 CVE-2026-99171 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

DEBIAN-CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

AZL-111314 CVE-2026-99167 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

AZL-111317 CVE-2026-99169 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

AZL-111323 CVE-2026-99172 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

DEBIAN-CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

DEBIAN-CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...