59325 matches found
DEBIAN-CVE-2026-98412
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrsequnitnew If memory allocation fails in pwrsequnitsetupdeps, pwrsequnitput is called to release the partially initialized unit. However, we've never initialized unit-list and...
DEBIAN-CVE-2026-98413
In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...
DEBIAN-CVE-2026-98410
In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HWRUNNING watchdog da9063wdtsuspend and da9063wdtresume only check watchdogactive, when the watchdog is left running by the driver sets WDOGHWRUNNING in da9063wdtprobe but userspac...
DEBIAN-CVE-2026-98416
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...
DEBIAN-CVE-2026-98401
In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...
DEBIAN-CVE-2026-98403
In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...
DEBIAN-CVE-2026-98400
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...
DEBIAN-CVE-2026-98408
In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...
DEBIAN-CVE-2026-98407
In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...
DEBIAN-CVE-2026-98404
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...
DEBIAN-CVE-2026-98406
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...
DEBIAN-CVE-2026-98402
In the Linux kernel, the following vulnerability has been resolved: net: icmp: avoid invalid transport header access in icmpsend tracepoint syzbot reported a WARNING triggered by DEBUGNETWARNONONCE: WARNING: at skbtransportheader include/linux/skbuff.h:3087 inline WARNING: at udphdr...
DEBIAN-CVE-2026-98399
In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...
DEBIAN-CVE-2026-98392
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...
DEBIAN-CVE-2026-98397
In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...
DEBIAN-CVE-2026-98394
In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...
DEBIAN-CVE-2026-98396
In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...
DEBIAN-CVE-2026-98393
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...
DEBIAN-CVE-2026-98398
In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...
DEBIAN-CVE-2026-98395
In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...
DEBIAN-CVE-2026-98387
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipherwalk return code handling in aess390 The return codes from skcipherwalkvirt were not properly checked before entering the processing loops in ecbaescrypt and ctraescrypt. If skcipherwalkvirt fails, the wa...
DEBIAN-CVE-2026-98389
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip gfx switchpowerprofile during GPU reset During resume from GPU reset, the gfx idle work may invoke switchpowerprofile before the reset completes. This causes the following assert error because the register access...
DEBIAN-CVE-2026-98391
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...
DEBIAN-CVE-2026-98386
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memsetio to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory ha-iobase + reqqueoff, not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through...
DEBIAN-CVE-2026-98388
In the Linux kernel, the following vulnerability has been resolved: exec: docloseonexec before taking execupdatelock docloseonexec currently happens while holding the execupdatelock, which is used in a lot of places that access process state to synchronize access checks. I recently added another...
DEBIAN-CVE-2026-98390
In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate rootspernode as 0, which crashes with a divid...
DEBIAN-CVE-2026-88842
A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...
DEBIAN-CVE-2026-101341
Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...
DEBIAN-CVE-2026-101339
A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field a HIP Rendezvous server can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is...
DEBIAN-CVE-2026-101338
When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the limit, the base64 decoder can write attacker controlled data of unlimited size. Zone files which are written out by NSD itself, such as for zones for which t...
DEBIAN-CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
DEBIAN-CVE-2026-90954
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...
DEBIAN-CVE-2026-88829
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...
DEBIAN-CVE-2026-86476
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the...
DEBIAN-CVE-2026-92386
Bulletin has no description...
DEBIAN-CVE-2026-87862
Bulletin has no description...
DEBIAN-CVE-2026-107928
Bulletin has no description...
DEBIAN-CVE-2026-92391
Bulletin has no description...
DEBIAN-CVE-2026-107929
Bulletin has no description...
DEBIAN-CVE-2026-92388
Bulletin has no description...
DEBIAN-CVE-2026-86414
Bulletin has no description...
DEBIAN-CVE-2026-92387
Bulletin has no description...
DEBIAN-CVE-2026-86413
Bulletin has no description...
DEBIAN-CVE-2026-86412
Bulletin has no description...
DEBIAN-CVE-2026-86410
Bulletin has no description...
DEBIAN-CVE-2026-92389
Bulletin has no description...
DEBIAN-CVE-2026-92390
Bulletin has no description...
DEBIAN-CVE-2026-86415
Bulletin has no description...