DEBIAN-CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

DEBIAN-CVE-2026-89555

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...

CVE-2026-89555

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskbmaypull mplsselectmultipath calls mplsmultipathhash to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label...

CVE-2026-89561

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6rplsrhrcv ipv6rplsrhrcv dereferences idev from in6devget without a NULL check when reading idev-cnf.rplsegenabled. When the device's MTU drops below IPV6MINMTU, addrconfifdown clears...

AZL-100830 CVE-2026-89552 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

DEBIAN-CVE-2026-89552

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

AZL-100103 CVE-2026-89547 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

DEBIAN-CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

CVE-2026-89552

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

AZL-100283 CVE-2026-89543 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

DEBIAN-CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

DEBIAN-CVE-2026-89528

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

AZL-100166 CVE-2026-89528 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

CVE-2026-89528

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

DEBIAN-CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

CVE-2026-89518

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix thisrq assumptions in dispatch kfuncs Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch may execute on a CPU different from the dispatched rq's. Several...

DEBIAN-CVE-2026-89509

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Embed counter driver data in rdmacounter allocation Commit 7e53b31acc7f "RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj" requires drivers implementing counter ops to embed struct rdmacounter in a...