DEBIAN-CVE-2026-99107

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99107

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

AZL-111203 CVE-2026-99112 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

AZL-111206 CVE-2026-99113 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

AZL-111209 CVE-2026-99114 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...

DEBIAN-CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

CVE-2026-99104

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor scxbypass claims bypass dispatch when the scheduler's depth goes from zero to one and releases it when the depth returns to zero, but propagates only...

AZL-111191 CVE-2026-99101 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

CVE-2026-99103

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq: BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr...

CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

CVE-2026-99102

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfssetattrsize ntfssetattrsize updates isize and resizes the on-disk attribute without holding mapping-invalidatelock. Page faults take the lock shared, so a fault racing the resize can resolve a VCN...

AZL-111194 CVE-2026-99106 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

DEBIAN-CVE-2026-99101

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

DEBIAN-CVE-2026-99105

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without...

DEBIAN-CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

DEBIAN-CVE-2026-99103

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq: BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr...

CVE-2026-99101

In the Linux kernel, the following vulnerability has been resolved: ntfs: move attribute payload before shrinking its record ntfsnewattrflags resizes the non-resident attribute record before moving its name and mapping pairs to their shorter-header offsets when compression or sparse state is...

CVE-2026-99105

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix stall when a task enqueued with SCXENQLAST lands back on its CPU's local DSQ With SCXOPSENQLAST, the last runnable task on a CPU is passed to ops.enqueue instead of being kept running. Exiting tasks without...