AZL-104526 CVE-2026-97918 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

CVE-2026-97914

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

CVE-2026-97919

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

DEBIAN-CVE-2026-97916

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

DEBIAN-CVE-2026-97914

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

DEBIAN-CVE-2026-97919

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

CVE-2026-97918

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

DEBIAN-CVE-2026-97917

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

AZL-104870 CVE-2026-97919 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

DEBIAN-CVE-2026-97915

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

DEBIAN-CVE-2026-97918

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

CVE-2026-97911

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

DEBIAN-CVE-2026-97904

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

DEBIAN-CVE-2026-97909

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

DEBIAN-CVE-2026-97908

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

DEBIAN-CVE-2026-97907

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

CVE-2026-97903

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97910

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

DEBIAN-CVE-2026-97903

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

DEBIAN-CVE-2026-97905

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...