CVE-2026-80991

A flaw was found in the Linux kernel's net: ravb module. A race condition exists during the Precision Time Protocol PTP clock teardown. This allows the ravbptpinterrupt function to attempt to use a PTP clock after it has been freed by ptpclockunregister, leading to a use-after-free vulnerability...

CVE-2026-89443

A flaw was found in the Linux kernel's platform/x86 ISST module. The isstifgetperflevelmask and isstifgetbasefreqmask functions fail to validate a user-provided 'level' parameter. A local attacker could exploit this by providing an invalid 'level' value, leading to an out-of-bounds read from the...

CVE-2026-89442

A flaw was found in the Linux kernel. The isstifclosassoc ioctl function in the platform/x86: ISST module contains an improper validation of the socketid. This allows a local attacker to cause an out-of-bounds access or a NULL pointer dereference. This could lead to a system crash, resulting in a...

CVE-2026-89563

A flaw was found in the ip6tunnel module of the Linux kernel. Incorrect handling of socket buffers skb during headroom reallocation in the ip6tnlxmit function can lead to a double-free vulnerability. This occurs when an error path is taken after the original skb has been consumed, but the caller...

CVE-2026-89709

A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvcops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow a local attacker to cause a denial of service. Mitigation...

CVE-2026-89719

A flaw was found in the Linux kernel's zram module. This vulnerability occurs when the readblockstate function calculates the number of pages before acquiring a device lock. If the zram device is reset and reinitialized with a smaller disk size, the function can attempt to access memory beyond th...

CVE-2026-89482

A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQOPWRITEZEROES commands, where the system fails to adequately validate the data length. A remote attacker could exploit this by sending specially crafted C2HData, leading...

CVE-2026-89527

A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, potentially causing a denial of service DoS by exhausting syst...

CVE-2026-89751

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix off-by-one in port I/O handling handlein and handleout in arch/x86/coco/tdx/tdx.c use: u64 mask = GENMASKBITSPERBYTE size, 0; GENMASKh, l includes bit h. For size=1 INB, this produces GENMASK8, 0 = 0x1FF 9 bits inste...

CVE-2026-89743

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: bound the device-reported response length nsmsendrecvmsglocked stores the virtqueue used-ring length reported by the NSM device into msg-resp.len without bounding it to the response buffer. A malicious or buggy backend...

CVE-2026-89718

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

AZL-100898 CVE-2026-89709 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

DEBIAN-CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

AZL-100737 CVE-2026-89556 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

DEBIAN-CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

DEBIAN-CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

AZL-100518 CVE-2026-89443 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate level in perf mask ioctls isstifgetperflevelmask and isstifgetbasefreqmask use the user-provided level as an index into perflevels via readpplevelinfo and readbflevelinfo, but neither helper validates...