AZL-100547 CVE-2026-89460 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

CVE-2026-89457

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

AZL-100277 CVE-2026-89451 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

CVE-2026-89451

In the Linux kernel, the following vulnerability has been resolved: iommu/sva: Set handle-dev before the SVA handle is visible iommuattachdevicepasid installs the new SVA attach handle in the group PASID lookup before iommusvabinddevice returns. A concurrent bind can therefore find and reuse the...

AZL-100799 CVE-2026-89439 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Add a NULL check for sstinst To be consistent with other places, add a NULL check for failed socket loading by checking isstcommon.sstinst...

CVE-2026-89442

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate socket ID in closassoc ioctl isstifclosassoc validates the user-supplied socketid with 'socketid topologymaxpackages', but isstcommon.sstinst is allocated with topologymaxpackages entries, so the vali...

DEBIAN-CVE-2026-81005

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

AZL-100268 CVE-2026-81005 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipmi: si: Fix NULL pointer dereference after failed registration trysmiinit allocates newsmi-sism and later calls ipmiregistersmimod, which maps to ipmiaddsmi. During ipmiaddsmi, the upper IPMI message handler obtains the initial...

AZL-100793 CVE-2026-80992 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

DEBIAN-CVE-2026-80992

In the Linux kernel, the following vulnerability has been resolved: net: ravb: avoid dereferencing an invalid PTP clock The PTP clock is unavailable before the first open, so querying its index can dereference a NULL pointer. Registration failures can also leave an error pointer in priv-ptp.clock...

DEBIAN-CVE-2026-80984

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

AZL-100223 CVE-2026-80984 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

CVE-2026-80984

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

DEBIAN-CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

AZL-100854 CVE-2026-80963 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

CVE-2026-80963

In the Linux kernel, the following vulnerability has been resolved: dm-stats: fix a crash if allocation of per-cpu data fails If "dmkvzallocpercpuallocsize, cputonodecpu" fails, the code jumps to the "out" label and calls dmstatfree. dmstatfree does "foreachpossiblecpucpu...

DEBIAN-CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-80956

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: only hand out initialized cache segments getcachesegment scans the segment map up to cache-nsegs, the physical device segment count, but cachesegsinit only initializes the first cacheinfo-nsegs segments. A crafted imag...

CVE-2026-89552

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...