DEBIAN-CVE-2026-98297

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

DEBIAN-CVE-2026-98295

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

DEBIAN-CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

DEBIAN-CVE-2026-98300

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

DEBIAN-CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

AZL-106422 CVE-2026-98295 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

AZL-106080 CVE-2026-98300 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

AZL-106131 CVE-2026-98298 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98297

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98295

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

CVE-2026-98296

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

CVE-2026-98300

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

DEBIAN-CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

DEBIAN-CVE-2026-98289

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

DEBIAN-CVE-2026-98292

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

AZL-106050 CVE-2026-98292 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

AZL-106236 CVE-2026-98289 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

DEBIAN-CVE-2026-98291

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix off-by-one bounds check in RX submit btintelpciesubmitrx used frbdindex rxq-count to guard the FRBD array access, allowing frbdindex == rxq-count to pass through and index one element past the end of t...