AZL-111275 CVE-2026-99146 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmcinfo-startmmioaddr and later used by dmcloadprogram. Unlike the MMIO address table, the firmware loa...

DEBIAN-CVE-2026-99143

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

CVE-2026-99143

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicateparse adds two to nrpreds to reserve the terminal TRUE and FALSE entries. It also uses that increased value as the limit for parsed predicates. If the...

AZL-111257 CVE-2026-99136 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

DEBIAN-CVE-2026-99136

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in cryptdecpending cryptdecpending reads io-error before calling atomicdecandtest. Another context, for example cryptendio called from an interrupt, may set io-error and drop its reference...

DEBIAN-CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

DEBIAN-CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without common synchronization. mac802154performassociation stores the coordinato...

DEBIAN-CVE-2026-99140

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

DEBIAN-CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99137

In the Linux kernel, the following vulnerability has been resolved: cifs: don't update isize in cifsdotruncate without a cached handle If findwritablefile returns null, cifsfileflush will return 0 without issuing setfilesize, and the outer 'if !rc' block will set isize to 0 before telling the...

AZL-111254 CVE-2026-99135 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buff...

AZL-111248 CVE-2026-99132 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfssyncsbbuf xfssyncsbbuf holds sb/rtsb buffer locks across a synchronous xfstranscommit, which flushes the CIL push workqueue internally. If shutdown occurs during t...

AZL-111266 CVE-2026-99140 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without common synchronization. mac802154performassociation stores the coordinato...

CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

CVE-2026-99140

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARNONONCE!nest warning: WARNING: kernel/trace/ringbuffer.c:821 at ringbuffereventtimestamp Call trace: ringbuffereventtimestamp histfieldtimestamp...

AZL-111260 CVE-2026-99138 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

AZL-111251 CVE-2026-99133 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

DEBIAN-CVE-2026-99135

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integritymetadata handles a discard, it fills a buffer with DISCARDFILLER and writes it over the tags, maxblocks blocks at a time. If the kmalloc fails, the buff...

AZL-111263 CVE-2026-99139 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...