DEBIAN-CVE-2026-98243

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

DEBIAN-CVE-2026-98241

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

AZL-105984 CVE-2026-98245 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

DEBIAN-CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

DEBIAN-CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

DEBIAN-CVE-2026-98246

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

AZL-106437 CVE-2026-98246 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

AZL-106128 CVE-2026-98241 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

DEBIAN-CVE-2026-98245

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98246

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98243

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98245

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-98242

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98241

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

DEBIAN-CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

AZL-106221 CVE-2026-98236 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

AZL-106107 CVE-2026-98234 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...

AZL-106119 CVE-2026-98237 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...