AZL-101873 CVE-2026-90303 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

DEBIAN-CVE-2026-90303

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

CVE-2026-90303

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

DEBIAN-CVE-2026-90269

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

AZL-102291 CVE-2026-90264 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

DEBIAN-CVE-2026-90264

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

CVE-2026-90250

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

DEBIAN-CVE-2026-90250

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

AZL-102347 CVE-2026-90250 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

DEBIAN-CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

DEBIAN-CVE-2026-90192

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90129

In the Linux kernel, the following vulnerability has been resolved: virtioballoon: quiesce balloon work before device shutdown Commit 8bd2fa086a04 "virtio: break and reset virtio devices on deviceshutdown" added a generic virtio bus .shutdown handler that breaks and resets every virtio device...

DEBIAN-CVE-2026-90129

In the Linux kernel, the following vulnerability has been resolved: virtioballoon: quiesce balloon work before device shutdown Commit 8bd2fa086a04 "virtio: break and reset virtio devices on deviceshutdown" added a generic virtio bus .shutdown handler that breaks and resets every virtio device...

CVE-2026-90097

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

AZL-102971 CVE-2026-90097 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

DEBIAN-CVE-2026-90097

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

AZL-102546 CVE-2026-90083 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: actife: Only operate on Ethernet frames actife encapsulates/decapsulates the original Ethernet header and uses skb-dev-hardheaderlen as the length of that header. That is only correct for Ethernet devices: on a device...

CVE-2026-90059

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NETIPALIGN in the RX DMA offset Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the...