DEBIAN-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

DEBIAN-CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

AZL-104534 CVE-2026-97993 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

AZL-104217 CVE-2026-97994 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

DEBIAN-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

AZL-104819 CVE-2026-97992 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

AZL-104330 CVE-2026-97607 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

DEBIAN-CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

UBUNTU-CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

UBUNTU-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

UBUNTU-CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

UBUNTU-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97993 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97993

A vulnerability exists in the Linux kernel 's vhost-vdpa driver within the vhost_vdpa_set_config_call() function. The issue arises because the code swaps the return value of eventfd_ctx_fdget() into v->config_ctx before checking for errors, briefly holding an ERR_PTR . If a config interrupt oc...

CVE-2026-97994

The Linux kernel contains a vulnerability in the vhost-vdpa component where vhost_vring_set_num() accepts a queue size that exceeds the device's maximum capacity without proper validation against get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can exploit this to configure a queue la...