AZL-102224 CVE-2026-92523 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

AZL-102617 CVE-2026-92525 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

DEBIAN-CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

DEBIAN-CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92523

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

DEBIAN-CVE-2026-92513

In the Linux kernel, the following vulnerability has been resolved: RDMA/manaib: drain QP references after partial table insertion manatablestoreudqp publishes a QP at its send-queue id before inserting the receive-queue id, dropping the XArray lock between the two xainsertirq calls. A concurrent...

DEBIAN-CVE-2026-92514

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

AZL-102210 CVE-2026-92514 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

AZL-102183 CVE-2026-92509 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

DEBIAN-CVE-2026-92509

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

AZL-102609 CVE-2026-92508 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

DEBIAN-CVE-2026-92510

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

AZL-102726 CVE-2026-92507 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

AZL-102734 CVE-2026-92511 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

DEBIAN-CVE-2026-92511

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

DEBIAN-CVE-2026-92512

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-92507

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92509

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-92508

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...