CVE-2026-99006

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99007

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...

CVE-2026-99008

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-99012

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

DEBIAN-CVE-2026-99000

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

DEBIAN-CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

DEBIAN-CVE-2026-99003

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

DEBIAN-CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

DEBIAN-CVE-2026-98998

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

DEBIAN-CVE-2026-99005

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

DEBIAN-CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

DEBIAN-CVE-2026-99002

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-98998

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-99000

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

CVE-2026-99002

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...