DEBIAN-CVE-2026-90289

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

AZL-102177 CVE-2026-90187 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

DEBIAN-CVE-2026-90118

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

DEBIAN-CVE-2026-90110

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...

DEBIAN-CVE-2026-90068

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

AZL-101984 CVE-2026-90068 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

CVE-2026-90068

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

SUSE CVE-2026-89869

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: use disableirq during power-off The IRQ is registered as a threaded IRQ. Using disableirqnosync in irisvpupoweroff does not wait for an already queued threaded IRQ handler to complete before returning. As a...

CVE-2026-93166 wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: debug: fix off by on in rtw89ppdustr This comparison should be = to avoid an out of bounds access...

CVE-2026-93166

This Linux kernel vulnerability affects the rtw89 Wi-Fi driver, specifically the debug function rtw89_ppdu_str() . The root cause is an off-by-one error : a > comparison should have been >=, allowing an out-of-bounds memory access when processing PDU strings. The fix is provided in kernel p...

CVE-2026-93166 wifi: rtw89: debug: fix off by on in rtw89_ppdu_str()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: debug: fix off by on in rtw89ppdustr This comparison should be = to avoid an out of bounds access...

EUVD-2026-82274

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: debug: fix off by on in rtw89ppdustr This comparison should be = to avoid an out of bounds access...

CVE-2026-93064 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

CVE-2026-93064

This is a Linux kernel vulnerability in the iwlwifi mvm driver (Intel wireless). The root cause is an off-by-one error in iwl_mvm_frob_txf_key_iter(), the TXF key sanitiser. When a full key match is found, the memset start offset uses i - keylen instead of the correct i + 1 - keylen, which zeroes...

CVE-2026-93064 wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

EUVD-2026-82174

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

CVE-2026-90289

CVE-2026-90289 is a Linux kernel vulnerability in the drm/amd/display subsystem. The constant AMDGPU_DM_MAX_DISPLAY_INDEX was defined as 31 (implying 32 connectors) but used as a count, creating an off-by-one mismatch with the DRM core, which supports a maximum of 32 connectors. The fix renames t...

CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

CVE-2026-90289 drm/amd/display: Resize MST HDCP per-connector arrays to 32

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

EUVD-2026-81882

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...