DEBIAN-CVE-2026-98822

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

DEBIAN-CVE-2026-98825

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

AZL-109313 CVE-2026-98824 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

DEBIAN-CVE-2026-98826

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

DEBIAN-CVE-2026-98819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

DEBIAN-CVE-2026-98827

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

AZL-108993 CVE-2026-98822 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

AZL-109386 CVE-2026-98823 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

CVE-2026-98818

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98821

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98820

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

CVE-2026-98827

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

AZL-109260 CVE-2026-98826 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

AZL-108599 CVE-2026-98819 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98822

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

CVE-2026-98825

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

CVE-2026-98819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98823

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

AZL-109254 CVE-2026-98825 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...