DEBIAN-CVE-2026-97581

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

DEBIAN-CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

DEBIAN-CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

DEBIAN-CVE-2026-97572

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate RX ring init failures in bnxtinitnic bnxtinitrxrings returns an error when bnxtalloconerxring fails, but bnxtinitnic discards that return value and calls bnxtinitchip, which enables TPA. If an allocation fails,...

DEBIAN-CVE-2026-97566

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

DEBIAN-CVE-2026-97569

In the Linux kernel, the following vulnerability has been resolved: bnxten: Prevent queue stop with deferred completions When the driver receives a burst of packets, it can mark a BD with the NOCMPL bit to defer completions. The expectation is that the last packet in the ring will have this bit...

DEBIAN-CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

DEBIAN-CVE-2026-97571

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

DEBIAN-CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

DEBIAN-CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

DEBIAN-CVE-2026-97568

In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit when copying the info in subflowulpclone. To fix this, no need to extend the joinentry structure: backup is coming from struct...

DEBIAN-CVE-2026-97567

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...

DEBIAN-CVE-2026-97556

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

DEBIAN-CVE-2026-97563

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

DEBIAN-CVE-2026-97557

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

DEBIAN-CVE-2026-97558

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

DEBIAN-CVE-2026-97561

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

DEBIAN-CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

DEBIAN-CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

DEBIAN-CVE-2026-97562

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

DEBIAN-CVE-2026-97553

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

DEBIAN-CVE-2026-97552

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

DEBIAN-CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

DEBIAN-CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

DEBIAN-CVE-2026-97551

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

DEBIAN-CVE-2026-97554

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

DEBIAN-CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

DEBIAN-CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

DEBIAN-CVE-2026-97548

In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount maxlevelsondisk functions The maxlevelsondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount...

DEBIAN-CVE-2026-97543

In the Linux kernel, the following vulnerability has been resolved: xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak in xchkdirtreecreatepath if we create the directory path object but appending the name to the path fails. When this happens, we don't tear...

DEBIAN-CVE-2026-97544

In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak dqacct if rhashtable insertion fails LOLLM observes that xqcheckmodliveinodqtrx doesn't free the newly allocated dqa object if rhashtable insertion fails. Fix this leak...

DEBIAN-CVE-2026-97546

In the Linux kernel, the following vulnerability has been resolved: xfs: don't spin forever on zero-length dirents when salvaging them LOLLM noticed that xrepdirrecoverdata can spin forever if it encounters an unused dirent that claims to have length zero. Fix that, and prevent the same thing fro...

DEBIAN-CVE-2026-97538

In the Linux kernel, the following vulnerability has been resolved: hwmon: asusrogryujin Validate HID report lengths rogryujinrawevent parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consu...

DEBIAN-CVE-2026-97541

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: don't store usbdeviceid usbdeviceid is not guaranteed to live longer than probe due to presence of dynamic ID. All information apart from driverdata can be easily retrieved from usbdevice, so just store driverdata...

DEBIAN-CVE-2026-97539

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is...

DEBIAN-CVE-2026-97545

In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak newbp if xfsbtreebloaddropbuf fails LOLLM observes that in xfsbtreebloadprepblock, xfsbtreebloaddropbuf can hit an IO error if writing the delwri buffer list to disk fails. In this case, we fail to release newbp,...

DEBIAN-CVE-2026-97540

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

DEBIAN-CVE-2026-97542

In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrepagflfill LOLLM also points out that the xagbbitmapset call in xrepagflfill can fail, but we don't check the result of xagbbitmapwalk, so we silently drop the error and proceed with inconsiste...

DEBIAN-CVE-2026-97535

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte 128-bit array in both vpctrlentry24xx and vpctrlentry24xxext...

DEBIAN-CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

DEBIAN-CVE-2026-97530

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xxcopymultiplepkt and qla27xxcopyfpinpkt poll rspq-ringptr-signature for RESPONSEPROCESSED 0xDEADDEAD to decide whether the next continuation IOCB has arrive...

DEBIAN-CVE-2026-97532

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

DEBIAN-CVE-2026-97533

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm read lock on attribute changes to avoid UAF A previous commit protected against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Deni...

DEBIAN-CVE-2026-97534

In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust freesections during freesegmentrange In freesegmentrange, MAINSECSsbi is temporarily reduced by secs to restrict block allocation to the safe remaining main area while valid blocks in the truncated range a...

DEBIAN-CVE-2026-97536

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxxmsixrspq schedules qladowork via queueworkha-wq, &qpair-qwork. qladowork dereferences the qpair vha, rsp and takes...

DEBIAN-CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

DEBIAN-CVE-2026-97531

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition format-1 handling walks ha-vplist under vportslock, takes a vrefcount on the matching vport and calls qlaupdatehostmap to register its...

DEBIAN-CVE-2026-97527

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport-unsolctxhead list is modified from several contexts without a common lock. Entries are added in qla2xxxprocesspurlsiocb from the response queue ISR...

DEBIAN-CVE-2026-97523

In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mssnow reset to 0 for a...

DEBIAN-CVE-2026-97525

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly without going through the standard page table allocation routines such as ptealloconekernel when the CPA code splits a large page...