DEBIAN-CVE-2026-98249

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

AZL-106368 CVE-2026-98253 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

DEBIAN-CVE-2026-98252

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

AZL-106278 CVE-2026-98252 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

DEBIAN-CVE-2026-98251

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98248

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98249

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

CVE-2026-98250

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

CVE-2026-98252

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98251

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98253

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

DEBIAN-CVE-2026-98243

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

DEBIAN-CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

AZL-105984 CVE-2026-98245 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

DEBIAN-CVE-2026-98246

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

AZL-106128 CVE-2026-98241 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

DEBIAN-CVE-2026-98245

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

DEBIAN-CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

DEBIAN-CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

AZL-106437 CVE-2026-98246 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...