AZL-109422 CVE-2026-98628 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

AZL-108719 CVE-2026-98629 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

AZL-108737 CVE-2026-98625 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

CVE-2026-98623

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98626

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98624

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...

CVE-2026-98625

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98628

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

AZL-108708 CVE-2026-98612 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

AZL-109034 CVE-2026-98621 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

AZL-108596 CVE-2026-98614 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

DEBIAN-CVE-2026-98620

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

DEBIAN-CVE-2026-98616

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn-numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend tears the datapath down via...

CVE-2026-98613

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98615

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

CVE-2026-98620

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...