CVE-2026-98692

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tbtunnelallocdp takes an optional callback which is run from dprxwork once the DPRX capabilities read has completed. Without that callback tbdpdprxstart reads the...

CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

AZL-108953 CVE-2026-98687 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

DEBIAN-CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

DEBIAN-CVE-2026-98687

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

DEBIAN-CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

AZL-108900 CVE-2026-98694 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-98687

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

DEBIAN-CVE-2026-98682

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

DEBIAN-CVE-2026-98679

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kxcjk-1013: reject duplicate event disable The IIO core does not filter duplicate writes to the event enable attribute. kxcjk1013writeeventconfig already ignores repeated enable requests, but a repeated disable reques...

AZL-109164 CVE-2026-98681 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races The invalidHandle, swapfile, oplockbreakcancelled, offload, and statusfiledeleted fields are stored in the same bitfield byte in struct cifsFileInfo, but ar...

AZL-109121 CVE-2026-98686 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

CVE-2026-98678

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4030: fix invalid oversamplingratio validation In ad4030setavgframelen, the logarithm is calculated before input validation. Passing zero or negative values leads to an undefined result from ilog2. Validate that the...

CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

CVE-2026-98682

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-98685

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddlin...

CVE-2026-98683

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98684

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...