[SECURITY] [DLA 4702-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4702-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 28, 2026 https://wiki.debian.org/LTS -...

CVE-2026-10682 Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace

The userspace verifier zvrfylogfilterset for the logfilterset syscall in subsys/logging/logmgmt.c performed a signed comparison against the int16t srcid parameter: srcid int16tlogsrccntgetdomainid. Any negative value for srcid e.g. -1 trivially satisfied this check and was forwarded into...

CVE-2026-64393

A flaw was found in the Linux kernel's ksmbd component. This vulnerability allows a local attacker to escalate privileges by manipulating Server Message Block SMB2 SETINFO operations. The system incorrectly uses the ksmbd worker's credentials instead of the original user's credentials when...

CVE-2026-64398

A flaw was found in the Linux kernel's ksmbd component. An authenticated Server Message Block SMB client with only FILEWRITEATTRIBUTES permission can bypass a security check in the FSCTLSETZERODATA function. This allows the client to zero out file data, leading to data destruction and a denial of...

UBUNTU-CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header

A flaw was found in undici. When undici processes Set-Cookie headers, it incorrectly interprets the SameSite attribute, accepting partial matches instead of exact ones. This allows a malicious server to downgrade a cookie's SameSite policy to a less secure setting, potentially leading to unintend...

SUSE CVE-2026-64300

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

SUSE CVE-2026-64367

In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodixhidsetrawreport builds a protocol frame in a 128-byte stack buffer tmpbuf, writing an 11-12 byte header followed by the caller-supplied report data...

SUSE CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

SUSE CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

SUSE CVE-2026-64413

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

CVE-2026-64393

In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SETINFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the...

CVE-2026-64394

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITEDAC/WRITEOWNER check to SMB2 SETINFO SECURITY commit cc57232cae23 "ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE" added a fp-daccess gate to fsctlsetsparse and noted that...

CVE-2026-64367

In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodixhidsetrawreport builds a protocol frame in a 128-byte stack buffer tmpbuf, writing an 11-12 byte header followed by the caller-supplied report data...

UBUNTU-CVE-2026-64398

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTLSETZERODATA FSCTLSETZERODATA in smb2ioctl destroys file data via ksmbdvfszerodata - vfsfallocatePUNCHHOLE/ZERORANGE after checking only the share-level KSMBDTREECONNFLAGWRITABLE, with no...

UBUNTU-CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

UBUNTU-CVE-2026-64393

In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SETINFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and LSM checks using the...

CVE-2026-64519 NFSD: Fix infinite loop in layout state revocation

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...