DEBIAN-CVE-2026-68391

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: hold reference for hciconn in mgmtpendingcmds Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Use of hciconn in hcisync callbacks also needs to hold refcount to avoi...

DEBIAN-CVE-2026-68389

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Clear memdump state on invalid dump size qcacontrollermemdump allocates qca-qcamemdump before processing the first dump packet. For a sequence-zero packet it then disables IBS, marks memdump collection active,...

DEBIAN-CVE-2026-68392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

DEBIAN-CVE-2026-68390

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold hdev-lock for hciconnparams lookups hciconnparamslookup requires hdev-lock be held, otherwise the list iteration or param access is not safe. Hold hdev-lock for params lookups in hcisync...

DEBIAN-CVE-2026-68394

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: revalidate LOADCONNPARAM queued update MGMTOPLOADCONNPARAM queues connupdatesync when a single parameter update changes an existing LE central connection. The queued work currently stores a borrowed hciconnparams...

DEBIAN-CVE-2026-68395

In the Linux kernel, the following vulnerability has been resolved: ata: satadwc460ex: enable SATA interrupts only after IRQ handler is registered satadwcenableinterrupts is called before platformgetirq and atahostactivate, leaving the SATA controller's interrupt mask enabled without a registered...

DEBIAN-CVE-2026-68393

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: extend connhash lookup critical sections Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF. Extend critical section to cover both hciconnhash lookup...

DEBIAN-CVE-2026-68380

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free of mmstruct in job scheduler amdxdnacmdsubmit stores current-mm in job-mm without holding any reference. aie2schedjobrun later access job-mm from the DRM scheduler worker thread. With only a raw...

DEBIAN-CVE-2026-68382

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

DEBIAN-CVE-2026-68383

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Keep scheduler timeline name alive The scheduler keeps a pointer to the timeline name, but q-name is freed with the exec queue while scheduler fences can still reference it. Store the name in struct xegucexecqueue so ...

DEBIAN-CVE-2026-68387

In the Linux kernel, the following vulnerability has been resolved: can: raw: add locking for raw flags bitfield With commit 890e5198a6e5 "can: raw: use bitfields to store flags in struct rawsock" the formerly separate integer values have been integrated into a single bitfield. This led to a...

DEBIAN-CVE-2026-68385

In the Linux kernel, the following vulnerability has been resolved: s390/checksum: Fix csumpartial without vector facility Currently csumpartial calls csumcopy with copy=false and dst=NULL. On machines without the vector facility, csumcopy falls back to cksmdst, ..., causing the checksum to be...

DEBIAN-CVE-2026-68381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn during async oplock break notification smb2oplockbreaknoti and smb2leasebreaknoti store a ksmbdconn pointer in an async ksmbdwork and then queue that work on ksmbd-io. The work only increments conn-rcount, which...

DEBIAN-CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

DEBIAN-CVE-2026-68375

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

DEBIAN-CVE-2026-68376

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

DEBIAN-CVE-2026-68379

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket reference and jump to discardit upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcptwbucket...

DEBIAN-CVE-2026-68377

In the Linux kernel, the following vulnerability has been resolved: net/sched: acttunnelkey: Defer dstrelease to RCU callback Fix a race-condition use-after-free in tunnelkeyreleaseparams. The function releases the metadatadst of the old params synchronously via dstrelease while deferring the...

DEBIAN-CVE-2026-68372

In the Linux kernel, the following vulnerability has been resolved: usb: core: port: Deattach Type-C connector on component unbind connectorunbind is the mirror of connectorbind, but it is missing the symmetric call to typecdeattach that connectorbind makes via: if portdev-child...

DEBIAN-CVE-2026-68374

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously freed in usbresetandverifydevice, a function that is commonly called i...