CVE-2026-89632

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

AZL-100241 CVE-2026-89628 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

AZL-100757 CVE-2026-89632 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

DEBIAN-CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89633

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

DEBIAN-CVE-2026-89627

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

DEBIAN-CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

AZL-100359 CVE-2026-89627 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccatreportevent duplicates each report with kmemdup and stores the allocation in a circular-buffer slot. The allocation is released only when that slot is reused. The...

DEBIAN-CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

AZL-100335 CVE-2026-89622 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

AZL-100731 CVE-2026-89624 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...

DEBIAN-CVE-2026-89619

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: bound GETREPORT response to the caller buffer quickspihidrawrequest receives the caller's buffer length in len, but quickspigetreport never sees it and copies the whole device-supplied response...

AZL-100494 CVE-2026-89625 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: sony: fix UAF of ghlpoketimer / ghlurb at driver unbind For GHL Guitar Hero Live dongles, sonyprobe arms a periodic timer: ghlmagicpoke the timer callback submits sc-ghlurb, and the URB completion ghlmagicpokecb re-arms the...

DEBIAN-CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

AZL-100644 CVE-2026-89621 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89620

In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-quickspi: validate report size before copy writecmdtotxdma builds an output report in qsdev-reportbuf, a heap buffer allocated in quickspiallocreportbuf to the device-descriptor derived maxreportlen a fe...

CVE-2026-89624

In the Linux kernel, the following vulnerability has been resolved: HID: universal-pidff: stop the device when force-feedback init fails universalpidffprobe starts the device with hidhwstart and then, if force-feedback initialisation fails, returns the error through a label that only does "return...