CVE-2026-93395

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

AZL-102744 CVE-2026-93182 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

DEBIAN-CVE-2026-93182

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

CVE-2026-93182

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

AZL-102249 CVE-2026-93179 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

AZL-103031 CVE-2026-93062 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

DEBIAN-CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93062

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

AZL-102938 CVE-2026-90370 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

DEBIAN-CVE-2026-90370

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996mcugetchipconfig The response TLV loop advanced by tlv-len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during...

DEBIAN-CVE-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

CVE-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

DEBIAN-CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

DEBIAN-CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

DEBIAN-CVE-2026-90051

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

SUSE CVE-2026-89819

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane degamma LUT size was never validated before use. setdmplanedegamma...

SUSE CVE-2026-89821

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in islutlinear islutlinear computes the expected value of each entry with expected = i MAXDRMLUTVALUE / size - 1; If it is ever called with a single-entry LUT, size - 1 is zero and the kernel...

SUSE CVE-2026-90035

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...