DEBIAN-CVE-2026-89742

In the Linux kernel, the following vulnerability has been resolved: rapidio: mportcdev: fix use-after-free in dmareqfree dmareqfree acquires bufmutex through req-map, drops the mapping reference with krefput, and then dereferences req-map again to unlock the mutex. If krefput drops the last...

DEBIAN-CVE-2026-89736

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix use-after-free on sound card disconnect gaudiocleanup invokes sndcardfreewhenclosed to initiate sound card teardown and immediately frees the underlying struct snduacchip context. However,...

DEBIAN-CVE-2026-89741

In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-dev: fix error handling in videoregisterdevice" This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a. The intentions of that patch were good, but it doesn't work. The idea is that if deviceregister...

DEBIAN-CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

DEBIAN-CVE-2026-89731

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxlrchgetaerinfo out-of-bounds AER register read cxlrchgetaerinfo copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aercapabilityregs. This struct is a...

DEBIAN-CVE-2026-89728

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Fix out-of-bounds access for newdevs mask When software initiates DAA Dynamic Address Assignment, the controller reports the result via the NRSPQP Normal Response Queue Port Register. The data length field of the...

DEBIAN-CVE-2026-89735

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: remove default configfs groups on teardown fmidi2allocinst creates default configfs child groups for the default endpoint and default block using configfsadddefaultgroup, setting their internal refcount to 1...

DEBIAN-CVE-2026-89734

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix null pointer dereference in uvcgvideoinit In uvcgvideoinit, if kthreadrunworker fails, the error logged uses uvcgerr, however, the pointer it uses: video-uvc is not assigned at this point, triggering a null...

DEBIAN-CVE-2026-89729

In the Linux kernel, the following vulnerability has been resolved: HID: sensor-hub: Fix out-of-bounds write in sensorhubgetfeature sensorhubgetfeature clamps its return value to the caller's buffer size, but the copy loop still copies field-reportsize / 8 bytes for each report value. A malicious...

DEBIAN-CVE-2026-89732

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Prevent deadlock during ep0 read loop Currently, ffsep0read holds ffs-mutex when it prepares to go to sleep waiting for an event. When no setup events are pending, it calls waiteventinterruptibleexclusivelockedi...

DEBIAN-CVE-2026-89733

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: fix dangling pointers in uvcfunctionbind and uvcfunctionunbind In uvcfunctionbind error path, we use usbepfreerequest which uses uvc-controlreq but does not set it to NULL afterwards. Thus, uvc-controlreq is a...

DEBIAN-CVE-2026-89730

In the Linux kernel, the following vulnerability has been resolved: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write The trailing byte path in alteracvpsendblock dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or...

DEBIAN-CVE-2026-89726

In the Linux kernel, the following vulnerability has been resolved: lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen Patch series "lib/ucs2string.c: fix out-of-bounds read in ucs2strnlen", v2. This series fixes an off-by-one out-of-bounds read in ucs2strnlen. The first patch is the real fi...

DEBIAN-CVE-2026-89724

In the Linux kernel, the following vulnerability has been resolved: media: vicodec: fix out-of-bounds write in FWHT encoder vidiocsfmtvidout sizes the encoder CAPTURE buffer from the compressed descriptor pixfmtfwht, whose sizeimagemult is 3: codedw codedh 3 + sizeofstruct fwhtcframehdr...

DEBIAN-CVE-2026-89725

In the Linux kernel, the following vulnerability has been resolved: media: cec: stm32: prevent out-of-bounds write on RX overflow stm32rxdone appends each received CEC byte to rxmsg.msg using rxmsg.len as the write index, incrementing it on every RXBR receive-byte-ready interrupt without checking...

DEBIAN-CVE-2026-89722

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Fix out-of-bounds read in pciwritelegacyio pciwritelegacyio loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote: if count != 1 && count != 2 && count != 4 return -EINVAL; return...

DEBIAN-CVE-2026-89721

In the Linux kernel, the following vulnerability has been resolved: phy: rockchip-samsung-dcphy: fix out-of-range maxregister The PHY register block is 64KB, so with a register stride of 4 the last accessible register sits at offset 0xfffc. maxregister names 0x10000, one register past the end of...

DEBIAN-CVE-2026-89723

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix slab-out-of-bounds in nilfsdirectpropagate after truncation Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error in nilfsdirectpropagate during testing. Analysis revealed that after truncating a file...

DEBIAN-CVE-2026-89719

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in readblockstate readblockstate calculates nrpages before taking devlock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nrpages still describes the old...

DEBIAN-CVE-2026-89720

In the Linux kernel, the following vulnerability has been resolved: ubifs: fix out-of-bounds read in signature length check ubifssbverifysignature bounds the on-disk ubifssignode-len field before handing the signature payload to verifypkcs7signature, but the check has the wrong sign: if...

DEBIAN-CVE-2026-89717

In the Linux kernel, the following vulnerability has been resolved: zram: set default primary compressor in zramdestroycomps Patch series "zram: fix zram issues reported by sashiko". Sashiko drove by and reported 1 a couple of zram issues: a possible BUGON in zlib code due to missing winbits rang...

DEBIAN-CVE-2026-89718

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writebackstore Patch series "zram: fix stale scan bounds after reinitialization". Both writebackstore and readblockstate derive their table scan bounds from zram-disksize before acquiring devlock...

DEBIAN-CVE-2026-89716

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

DEBIAN-CVE-2026-89715

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfsuuidaddfile failure When nfsuuidaddfile races with nfsuuidput tearing down uuid-net, it returns -ENXIO without publishing nfl-nfsuuid via rcuassignpointer. nfsopenlocalfh then enters its error bran...

DEBIAN-CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

DEBIAN-CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

DEBIAN-CVE-2026-89714

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

DEBIAN-CVE-2026-89709

In the Linux kernel, the following vulnerability has been resolved: lockd, nfsd: RCU-protect nlmsvcops dispatch nlmsvcops is published by nfsdlockdinit and cleared by nfsdlockdshutdown with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer...

DEBIAN-CVE-2026-89708

In the Linux kernel, the following vulnerability has been resolved: nfsd: RCU-protect clcbsession to fix use-after-free on session teardown After a DESTROYSESSION the per-session teardown path can free a session while rpciod still holds an inflight callback rpctask that dereferences...

DEBIAN-CVE-2026-89712

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart sscexpireumount walk after dropping nfsdssclock nfsd4sscexpireumount walks nn-nfsdsscmountlist with listforeachentrysafeni, tmp, .... For each expired entry it sets nsuibusy = true, drops nfsdssclock to run mntput o...

DEBIAN-CVE-2026-89710

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfslayoutprocess forget path When the server returns a new layout stateid while a valid one is still held, pnfslayoutprocess calls pnfsmarkmatchinglsegsreturn on the on-stack freeme list a...

DEBIAN-CVE-2026-89711

In the Linux kernel, the following vulnerability has been resolved: NFSD: remove flawed WARNONONCE from nfsdmodecheck The header for commit e75b23f9e323 "nfsd: check dcanlookup in fhverify of directories" details the assumption that justified adding the WARNONONCE to nfsdmodecheck, that assumptio...

DEBIAN-CVE-2026-89703

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SCSTATUSFREED in nfsd4droprevokedstid for delegations nfsd4droprevokedstid handles FREESTATEID for admin-revoked delegations but does not set SCSTATUSFREED before releasing cllock. revokedelegation uses this flag to...

DEBIAN-CVE-2026-89701

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate nseconds in TIMEDELEG decode paths The xdrgen-based TIMEDELEGACCESS and TIMEDELEGMODIFY decode arms store a raw uint32t nseconds directly into tvnsec without enforcing nseconds NSECPERSEC. The legacy...

DEBIAN-CVE-2026-89700

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate sockaddr length per family in listenerset nfsdsocknlpolicy declares NFSDASOCKADDR as a bare NLABINARY attribute with no minimum length. A CAPNETADMIN caller can send a 16-byte NFSDASOCKADDR with safamily=AFINET6,...

DEBIAN-CVE-2026-89702

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

DEBIAN-CVE-2026-89706

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn-writeverf at request time and reports it to the client via CBOFFLOAD after the worker kthread completes. When the post-copy vfsfsyncrange or...

DEBIAN-CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

DEBIAN-CVE-2026-89705

In the Linux kernel, the following vulnerability has been resolved: nfsd: restore rqstatuscounter to even on all nfsddispatch exit paths nfsddispatch sets rqstatuscounter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-loc...

DEBIAN-CVE-2026-89704

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop nfsdcopyfilerange samples dst-fwberr into "since" after the copy loop, then uses it to detect writeback errors via filemapcheckwberr once vfsfsyncrange returns. Because t...

DEBIAN-CVE-2026-89690

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpcstatus UAF The rpcstatus netlink dumpit walks every in-flight svcrqst under rcureadlock and, for NFSv4 requests, reads opnums out of args-ops. But args-ops is a separate vmalloc buffer...

DEBIAN-CVE-2026-89693

In the Linux kernel, the following vulnerability has been resolved: nfsd: check nfsd4acltoattr return value in nfsd4create nfsd4create stores the return value of nfsd4acltoattr in status, but the switchcreate-crtype block unconditionally overwrites it in every branch. ACL translation errors are...

DEBIAN-CVE-2026-89698

In the Linux kernel, the following vulnerability has been resolved: nfsd: widen nfsdgenlrqstp address fields to sockaddrstorage struct nfsdgenlrqstp declares rqdaddr and rqsaddr as plain "struct sockaddr" 16 bytes. When an IPv6 NFS client is connected, nfsdgenlrpcstatuscomposemsg casts these fiel...

DEBIAN-CVE-2026-89695

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4decodeposixacl reads a u32 entry count off the wire and passes it straight to posixaclalloc and sortpaclrange. The latter is an On^2 bubble sort, so a client-chosen count...

DEBIAN-CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

DEBIAN-CVE-2026-89691

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear opcnt on compound arg release to prevent OOB read nfsd4releasecompoundargs resets args-ops to the inline iops8 array when the dynamically-allocated ops buffer is freed, but leaves args-opcnt at its original value whic...

DEBIAN-CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

DEBIAN-CVE-2026-89697

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

DEBIAN-CVE-2026-89692

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACKRUNNING on failed delegation recall queue nfsdbreakonedeleg sets NFSD4CALLBACKRUNNING via testandsetbit at entry to serialize recall work, then calls nfsd4runcb to queue the recall. When the queue attempt fail...

DEBIAN-CVE-2026-89688

In the Linux kernel, the following vulnerability has been resolved: nfsd: drop the stateid, not the stateowner, on seqidop replay retry In nfs4preprocessseqidop the stateid is obtained from nfsd4lookupstateid, which holds a reference on the nfs4stid sccount but takes no reference on the stateowne...