DEBIAN-CVE-2026-72038

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xxgetpfnum fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review...

DEBIAN-CVE-2026-72039

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix potential memory leak in bnx2xallocmembp If the allocation of fpi.tpainfo fails, the error path will not free the struct bnx2xfastpath allocated earlier, as it is not linked to the bp structure yet. Fix that by linking...

DEBIAN-CVE-2026-72034

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capablewrtmount The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount, so a non-NULL mntnamespace survives the nscapable dereference. The helper still assume...

DEBIAN-CVE-2026-72031

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD Phison PS3111-S11, DRAM-less drops off the bus after entering Device-Initiated Slumber during idle. With the default medpowerwithdipm policy the link...

DEBIAN-CVE-2026-72035

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

DEBIAN-CVE-2026-72037

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize ethsyslock spinlock before use lan743xhardwareinit calls pci11x1xstrapgetstatus during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire,...

DEBIAN-CVE-2026-72032

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If mlx5hwsmatcherresizesettarget fails, the replacement matcher is not...

DEBIAN-CVE-2026-72033

In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fillfrompart fillfrompart computes the size of a directory entry in sizet but stores it in a u32. An entry length near U32MAX wraps it to a small value, bypasses the bounds check, a...

DEBIAN-CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

DEBIAN-CVE-2026-72029

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: bound device offsets in the MUX downlink decoder muxdladbdecode walks a chain of aggregated datagram tables using offsets and lengths taken from the modem. firsttableindex, nexttableindex, tablelength,...

DEBIAN-CVE-2026-72024

In the Linux kernel, the following vulnerability has been resolved: mac802154: remove interfaces with RCU list deletion Queue wake, stop, and disable paths walk local-interfaces under RCU. The bulk hardware teardown path removes entries with listdel, so an asynchronous transmit completion can...

DEBIAN-CVE-2026-72025

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

DEBIAN-CVE-2026-72023

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix SQB pointer leak on init failure otx2inithwresources initializes SQ aura and pool resources before several later setup steps. On failure, errfreesqptrs only frees SQB pages, leaving the per-SQ sqbptrs arrays...

DEBIAN-CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

DEBIAN-CVE-2026-72022

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket's membership in...

DEBIAN-CVE-2026-72028

In the Linux kernel, the following vulnerability has been resolved: riscv: probes: save original sp in rethook trampoline Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r nttywrite $stack0' dynamicevents $ echo 1 events/kprobes/enable Unabl...

DEBIAN-CVE-2026-72027

In the Linux kernel, the following vulnerability has been resolved: mm/compaction: handle freepagesprepare properly in compactionfree freepagesprepare can fail but compactionfree does not handle the failure case. Failed pages should not be added back to cc-freepages for future use, since they can...

DEBIAN-CVE-2026-72026

In the Linux kernel, the following vulnerability has been resolved: irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If imsicsetupstate fails, the function returns without freeing the allocated...

DEBIAN-CVE-2026-72015

In the Linux kernel, the following vulnerability has been resolved: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list A pseudo-locked group's RMID is freed when it is created. On unmount rmdirallsub unconditionally frees all RMID of all groups, resulting in a double-free of t...

DEBIAN-CVE-2026-72013

In the Linux kernel, the following vulnerability has been resolved: riscv: Prevent NULL pointer dereference in machinekexecprepare A NULL pointer dereference issue is noticed in riscv's machinekexecprepare, where image-segmenti.buf might be NULL and copied unchecked. The NULL buf comes from...

DEBIAN-CVE-2026-72020

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd "ipvs: avoid kmemcachezalloc in ipvsconnnew" changed ipvsconnnew to allocate an ipvsconn object with kmemcachealloc. The function then initializes many fields...

DEBIAN-CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

DEBIAN-CVE-2026-72019

In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsecencrypt macsecencrypt reads the Ethernet header via ethhdrskb skb-head + skb-macheader to memmove the 12 source/destination MAC bytes forward and make room for the SecTAG. On the...

DEBIAN-CVE-2026-72014

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recvdlessread receives a PDATAREPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int datasize, and...

DEBIAN-CVE-2026-72016

In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Fix NULL kobject warning in cpuhpsmtenable On arm64, when booting with maxcpus greater than the number of present CPUs e.g., QEMU -smp cpus=4,maxcpus=8, some CPUs are marked as 'present' but have not yet been...

DEBIAN-CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

DEBIAN-CVE-2026-72011

In the Linux kernel, the following vulnerability has been resolved: s390/diag: Add missing arrayindexnospec call to memtopgetpagecount 'level' is user space controlled and used to read from an array. Add the missing arrayindexnospec call to prevent speculative execution...

DEBIAN-CVE-2026-72005

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

DEBIAN-CVE-2026-72009

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI The MIPI DSI and CSI domains share control bits for clock and reset, which can lead to incorrect behavior if one domain disables the shared resource while the oth...

DEBIAN-CVE-2026-72012

In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Call synchronizercu when unregistering This ensures that any RCU readers traversing the instance list have finished, before releasing the reference on the tracer that the instance points to...

DEBIAN-CVE-2026-72010

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: rebind mm mempolicy to effectivemems, not memsallowed Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOLFRELATIVENODES rebinds in response to a CPU hotplug event...

DEBIAN-CVE-2026-72006

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

DEBIAN-CVE-2026-72007

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: Fix i.MX8MP VC8000E power up sequence Per errata1: ERR050531: VPUNOC power down handshake may hang during VC8000E/VPUMIX power up/down cycling. Description: VC8000E reset de-assertion edge and AXI clock may have a...

DEBIAN-CVE-2026-72008

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check Should probe fail for HWVOTER type power domains, this driver was unconditionally trying to perform cleanup for DIRECTCTL domains, but only after checking if the...

DEBIAN-CVE-2026-72004

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

DEBIAN-CVE-2026-72003

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmfnotifyauthframerx takes the frame length from the firmware event and copies the frame body with the management header offset subtracted: u32 mgmtframelen = e-datal...

DEBIAN-CVE-2026-68479

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware patch shorter than the version field can make this subtraction underflow...

DEBIAN-CVE-2026-68477

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

DEBIAN-CVE-2026-68478

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: reject a card that reports too many blocks msbftlinitialize computes the zone count from the card block count with no bound: msb-zonecount = msb-blockcount / MSBLOCKSINZONE; ... for i = 0; i zonecount; i++...

DEBIAN-CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

DEBIAN-CVE-2026-68475

In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxiresetinit, when ioremap fails, the memory region obtained via requestmemregion is not released, leading to a resource leak. Add an errmemregion label to properly...

DEBIAN-CVE-2026-68474

In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufsmemmmapaccess spufsmemmmapaccess computes the local store offset as address - vma-vmstart, but bounds-checks it against vma-vmend instead of the local store size. On 64-bit, offset ...

DEBIAN-CVE-2026-68473

In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIGPPCE500 in maskuseraddress maskuseraddress incorrectly checks for CONFIGE500 instead of CONFIGPPCE500, causing maskuseraddressisel to not be used on E500 hardware. Fix the check to use the...

DEBIAN-CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

DEBIAN-CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

DEBIAN-CVE-2026-68469

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

DEBIAN-CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

DEBIAN-CVE-2026-68468

In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs mtdvirtconcatcreatejoin. Once a virtual concat has already been registered, the function builds the same name again and takes the equal-name branch. That...

DEBIAN-CVE-2026-68467

In the Linux kernel, the following vulnerability has been resolved: mtd: mchp23k256: use SPI match data for chip caps The driver stores chip capacity information in both the OF match table and the SPI id table. Probe currently uses ofdevicegetmatchdata, so a non-OF SPI modalias match falls back t...

DEBIAN-CVE-2026-68466

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: lpc32xxslc: fail DMA transfer on completion timeout lpc32xxxmitdma waits for the DMA completion callback but ignores waitforcompletiontimeout. A timed out DMA transfer is therefore unmapped and reported as successfu...