CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

DEBIAN-CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

DEBIAN-CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

AZL-104229 CVE-2026-98020 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

AZL-104381 CVE-2026-97991 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

DEBIAN-CVE-2026-97991

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

CVE-2026-97991

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

DEBIAN-CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

AZL-104823 CVE-2026-97931 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97931

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

AZL-104736 CVE-2026-97910 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

CVE-2026-97875

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

CVE-2026-97619

In the Linux kernel, the following vulnerability has been resolved: iouring/rw: end write accounting from -kicomplete Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the ioreqrwcomplete taskwork. However, only the fsnotify pa...

CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

DEBIAN-CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

DEBIAN-CVE-2026-97535

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte 128-bit array in both vpctrlentry24xx and vpctrlentry24xxext...