CVE-2026-99128

In the Linux kernel, the following vulnerability has been resolved: sctp: validate chunk length in the inqueue parser SCTP chunks always include a four-byte generic header, but sctpinqpop currently accepts shorter declared lengths. A zero-length chunk leaves chunkend at the current header. When...

CVE-2026-99126

In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Prevent XID null dereference The mpcvalidatexid function sets grp-savedxid2-xid2flag2 to 0x40 to signal XID validation error. If peer XID is NULL or r/w channel pairing mismatch happens, grp-savedxid2 is never...

CVE-2026-99131

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

DEBIAN-CVE-2026-99124

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While reporterrorwrite checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the lengt...

DEBIAN-CVE-2026-99127

In the Linux kernel, the following vulnerability has been resolved: pagepool: keep fragoffset aligned for odd-sized requests pagepoolallocfragnetmem rounds the requested fragment size with size = ALIGNsize, dmagetcachealignment; dmagetcachealignment returns 1 unless the architecture defines...

DEBIAN-CVE-2026-99131

In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged to, even though quotas were enforced on both gids and the...

DEBIAN-CVE-2026-99130

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: don't spin on local work the task can't run iouringcancelgeneric refuses to sleep while any ring on the exiting task's tctx has local work pending. It assumes the task is that ring's submitter and that the next...

CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

CVE-2026-99120

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...

AZL-111224 CVE-2026-99122 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

DEBIAN-CVE-2026-99123

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtiotransportrecvpkt looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening...

AZL-111212 CVE-2026-99115 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the clie...

DEBIAN-CVE-2026-99115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the clie...

CVE-2026-99118

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

AZL-111227 CVE-2026-99123 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtiotransportrecvpkt looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening...

DEBIAN-CVE-2026-99118

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

DEBIAN-CVE-2026-99116

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct puts for every inet...

DEBIAN-CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

CVE-2026-99121

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass...

CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...