CVE-2026-80842

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

CVE-2026-80843

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

AZL-99528 CVE-2026-80842 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

DEBIAN-CVE-2026-80842

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

AZL-99422 CVE-2026-80843 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

DEBIAN-CVE-2026-80843

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrmstateconstruct auth-trunc leak attachauthtrunc can allocate x-aalg while leaving x-props.aalgo at zero when the selected auth algorithm has no sadbalgid. One real case is cmacaes. xfrmstateconstruct then treats...

DEBIAN-CVE-2026-80835

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

CVE-2026-80835

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

CVE-2026-80815

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

DEBIAN-CVE-2026-80815

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status interrupt endpoint and mixer.c manages. On a device with that...

AZL-99633 CVE-2026-80819 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

CVE-2026-80819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

DEBIAN-CVE-2026-80819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...

DEBIAN-CVE-2026-80795

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

AZL-99483 CVE-2026-80795 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

CVE-2026-80795

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds write in ncitargetautoactivated ncitargetautoactivated appends a target to the fixed-size array ndev-targetsNCIMAXDISCOVEREDTARGETS and increments ndev-ntargets without first checking the array is full...

CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

AZL-99428 CVE-2026-80792 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

DEBIAN-CVE-2026-80792

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...

DEBIAN-CVE-2026-80783

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouserawevent magicmouserawevent handles DOUBLEREPORTID 0xf7 packets, which pack two touch reports into one, by splitting the packet and calling itself on each half. The only...