AZL-100166 CVE-2026-89528 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

AZL-100319 CVE-2026-89515 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

CVE-2026-89515

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

DEBIAN-CVE-2026-89515

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fill in DMA padding bytes in scsiallocsgtables During fuzz testing, the following issue was discovered: BUG: KMSAN: uninit-value in dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x217/0x310 dmamapsgattrs+0x4a/0x70...

AZL-100094 CVE-2026-89511 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

DEBIAN-CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

CVE-2026-89503

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

CVE-2026-89500

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

DEBIAN-CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

DEBIAN-CVE-2026-89500

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

CVE-2026-89499

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

DEBIAN-CVE-2026-89503

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

DEBIAN-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100568 CVE-2026-89487 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

AZL-100577 CVE-2026-89480 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

DEBIAN-CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...