Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 06571468 by Salvatore Bonaccorso at 2026-10-18T18:11:10+02:00 Merge Linux CVEs from kernel-sec - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,898 @@ +CVE-2026-98868 [dm-pcache: reject a kset that overruns its segment] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/7ac1f10f987a2ffae4aecf0e2ceca8f552b665cb (7.3-rc1) +CVE-2026-98867 [dm-pcache: bound the logical key offset from persistent memory] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/97fc4b53dbe4a983fdf093243067fa6a64562307 (7.3-rc1) +CVE-2026-98866 [sched/cache: Introduce task_struct->sched_cache_grp to fix UAF] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/b636fef85bda7d1bab9c0a45067ab1508d79d946 (7.3-rc5) +CVE-2026-98865 [sched_ext: Don't run ops.dequeue() with a DSQ lock held] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/cb86607ada73185f321baa7f9d94a08a3a40bbf5 (7.3-rc5) +CVE-2026-98864 [sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/7de9a6fb44eae4f05e68c805d58b9c618815adfa (7.3-rc5) +CVE-2026-98861 [fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/e0a6249190402a28f1e2925a81acf573157d55ef (7.3-rc6) +CVE-2026-98860 [HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c (7.3-rc6) +CVE-2026-98858 [io_uring: fix task_work add use-after-free with SQPOLL] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/a92193c91e8839fe5fc209616ea95465ae4b919d (7.3-rc6) +CVE-2026-98849 [pfcp: fix socket lifetime on netdevice registration failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/0f17d2e3dd9cda3ee6d94033d5e5489af168920d (7.3-rc6) +CVE-2026-98845 [tpm: Disable TPM on null key name mismatch] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/015fb29a748342a186f37b602ac70017098c8251 (7.3-rc6) +CVE-2026-98844 [netfs: clear post-EOF pagecache when extending a file via write] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/69bf14300b50631e7c2271289d347bbd1b19a06c (7.3-rc6) +CVE-2026-98842 [module: fix lost error code from codetag_load_module()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/c79cf15eb35a4c703bf18f8c33c47e80dd660f8e (7.3-rc6) +CVE-2026-98841 [virt: vmgenid: set driver_data before registering notification handlers] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/9f8139c6145cf17d690d6c414d43b4c0bef632fb (7.3-rc6) +CVE-2026-98832 [blk-cgroup: save IRQ state in blkg_tryget_closest()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/327c428ba79b13e4cc5253333a9d5c0aa5579bdf (7.3-rc6) +CVE-2026-98821 [block: reject polled dio with user integrity metadata] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/2a42e6fe1293f2e2d579c9fe5bbab056dd8b880e (7.3-rc6) +CVE-2026-98817 [ASoC: SDCA: Add better pm_runtime error handling in func probe] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/91094f9c86216898ce92141c26c8fec7e97544c0 (7.3-rc6) +CVE-2026-98804 [net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/bdea4980182e3badac74f04df6c07492b91c569e (7.3-rc6) +CVE-2026-98791 [net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/7b97273cbebe9dd4fddc457f0c4f2a124d0e3996 (7.3-rc6) +CVE-2026-98787 [bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/de020dc8049bfb2b22e3b6d99c031feb2e22d112 (7.3-rc6) +CVE-2026-98776 [binderfs: fix UAF write in binder_add_device] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/30d15f44a9e513ec2f257fdf192d9d1fa5af0799 (7.3-rc6) +CVE-2026-98774 [rust_binder: cancel deferred work items in thread exit] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/62479b6e5df82cbdf3c4145130928f233fae78fb (7.3-rc6) +CVE-2026-98759 [usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/88c7e458af53ff781a3f1051708395892b325576 (7.3-rc6) +CVE-2026-98731 [Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/7dbeb6935ac331b0cba6c41cabd8e9d02d5f64ea (7.3-rc6) +CVE-2026-98730 [Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/f771f96557a4d953a7e4d045870547271e36e819 (7.3-rc6) +CVE-2026-98729 [x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/d2457a7e2727dc747a61a50d65c2f259afce8c45 (7.3-rc6) +CVE-2026-98728 [tpm: fix off-by-four bounds check in tpm2_get_random()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/9b522400bf5c082feb9a0037a053ea822a2c7e4d (7.3-rc6) +CVE-2026-98727 [nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/4a5e49ba0abb8b4328d6318c9aef0c0121f95507 (7.3-rc6) +CVE-2026-98724 [nvmet: pci-epf: reject too-short SGL segments] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/5d5fbfbbacd1efb13a9bf91317d4fde859ede4b9 (7.3-rc6) +CVE-2026-98723 [nvmet: copy the hostid into the ctrl before creating PR pc_refs] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/5211fed41d7ec90e9ab7239dc4bffffe4d0b2b62 (7.3-rc6) +CVE-2026-98719 [KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/8abbc76120a74bfba1851bd97528099d715e45c6 (7.3-rc6) +CVE-2026-98718 [KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/973ea70393e885e540f714904e51bc6cac80e3d7 (7.3-rc6) +CVE-2026-98713 [KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/4bdd2b3a708c1feb701cb8b62feb8ad2fd77bb07 (7.3-rc6) +CVE-2026-98712 [KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/19bc5d79ece613f242b5ec03921a3b465321bfed (7.3-rc6) +CVE-2026-98702 [wifi: mac80211: reject invalid 320 MHz CSA bandwidth] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/56e236759f0a8dc910c2ae7cd3c161f298ee5794 (7.3-rc6) +CVE-2026-98693 [thunderbolt: Hold a router reference for each allocated HopID] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/032c59c7681c661b63123231824170c025afb7e7 (7.3-rc6) +CVE-2026-98691 [thunderbolt: Tear down inactive DP tunnels when the domain is stopped] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/0b457c6733f73421a3fb03786f13d67c618b5119 (7.3-rc6) +CVE-2026-98690 [thunderbolt: Fix domain reference leak when DPRX read is canceled] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/1fd1f67c94d30889377bba774f032ec15e8b9299 (7.3-rc6) +CVE-2026-98689 [thunderbolt: Don't access a DP tunnel after its DPRX read was canceled] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/419fa32fa5bc2d7fb9d0d15d5630b1c1090808b3 (7.3-rc6) +CVE-2026-98680 [iio: accel: kionix-kx022a: Prevent memory leak and fix state] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/e65e128b51a37dd1a9056ac3d1705d805a5c8bb0 (7.3-rc6) +CVE-2026-98678 [iio: adc: ad4030: fix invalid oversampling_ratio validation] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/d615210564205993e8f0e7ccb57cc2e66b7d5706 (7.3-rc6) +CVE-2026-98676 [iio: adc: ade9000: fix NULL pointer dereference in clkout registration] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/49ee1c6a3ebda6b7de06b2961b0e09c1c3fe536a (7.3-rc6) +CVE-2026-98675 [iio: adc: ade9000: handle Phase C dip events in IRQ1 handler] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/fafefa925ed7ec10383d9bf0378abf878b7f13cb (7.3-rc6) +CVE-2026-98673 [iio: adc: pac1934: check ACPI label duplication] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/64c82e7bd9c82b0c9276297df34a3579e8658f55 (7.3-rc6) +CVE-2026-98667 [iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/e787fd23d5063c61582c3c27522240b6e6703fde (7.3-rc6) +CVE-2026-98659 [iio: pressure: rohm-bm1390: Return error when read fails] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/b0e951ffc5a28141a106562997ca136ec6a0e1a3 (7.3-rc6) +CVE-2026-98658 [iio: proximity: aw96103: validate firmware data length] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/1a7c522a35477d70320bd64aba8e9de0c1058c6f (7.3-rc6) +CVE-2026-98863 [KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/10180a277549339020b08000206092c07e0bff5a (7.3-rc5) +CVE-2026-98862 [audit: fix exe mark UAF in kill_rules()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/aa650d87a498844060eecb1d336f4d46f4d1b0b3 (7.3-rc6) +CVE-2026-98859 [HID: multitouch: stop the release timer from being rearmed on remove] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/5acb2dace582f061aab5e14c399ac9480315f44b (7.3-rc6) +CVE-2026-98857 [ipvs: bound LBLCR and LBLC cache growth] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2a3c3de660f96865f303fd25f1285f2ffbfd521d (7.3-rc6) +CVE-2026-98856 [kprobes: Skip disarmed probes when checking optkprobe overlap] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/7a39c732a22ec4a369af9e19fbe3d666ec83eec4 (7.3-rc6) +CVE-2026-98855 [of/overlay: put property on deadprops only after changeset add succeeds] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c (7.3-rc6) +CVE-2026-98854 [of/overlay: only treat a positive changeset id as registered] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/44081d708b5b885487bac792db78324b7b4c267d (7.3-rc6) +CVE-2026-98853 [net: gso: limit recursive IP-in-IP segmentation] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763 (7.3-rc6) +CVE-2026-98852 [net: extend IPv6 exthdr detection of tunneled packets] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/5f0764cb1c81a9712bce605d38efe6d844a70b29 (7.3-rc6) +CVE-2026-98851 [netfilter: nft_flow_offload: drop flowtable reference on init error path] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/747928b5d4ff8c8de55138a54c13980e4bb88578 (7.3-rc6) +CVE-2026-98850 [net/packet: prevent TX_RING byte count overflow] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2cf81fc9505b148b1b70068303ea6ea4b1212403 (7.3-rc6) +CVE-2026-98848 [rtc: ac100: Assign .num before accessing .hws] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/6a4117eee82dd85f11bf898bf66026764011eeb6 (7.3-rc6) +CVE-2026-98847 [rtc: spear: initialize IRQ state before requesting alarm IRQ] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/055ef5ce9f67a6a3a1363fa663007f8196cc0fb8 (7.3-rc6) +CVE-2026-98846 [sctp: check RCV_SHUTDOWN after the sendmsg connect wait] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/4f1da630d13de0370e2f6361f961f1c8b384af1c (7.3-rc6) +CVE-2026-98843 [netfs: zero gaps in read-gaps folio to avoid writing back stale data] + - linux 7.2.10-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/8db55c5cd831a786a1a2a2d391aa80354535a353 (7.3-rc6) +CVE-2026-98840 [vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/226bd5603371cd9f6642cbb9e9a677f445de3530 (7.3-rc6) +CVE-2026-98839 [vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/39495ef5d6f8019e62d65807f217a7ca8232727a (7.3-rc6) +CVE-2026-98838 [vt: skip screen update for DEC alignment test on backgroup consoles] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/0928ed9bd7946baee911efa401088697836e3b1e (7.3-rc6) +CVE-2026-98837 [ALSA: caiaq: unregister the input device when probe fails] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/0b7bd20f6379bc5e431fd74d866390f5b5b63f3c (7.3-rc6) +CVE-2026-98836 [ALSA: line6: reject oversized playback packets] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/61b0a5a114fa4552892da5c0ff2f42e63bf08c6b (7.3-rc6) +CVE-2026-98835 [iio: accel: kionix-kx022a: Fix array boundary check] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/0e65412aee4f651d2c9785f542a13e4b44002a75 (7.3-rc6) +CVE-2026-98834 [mtd: core: avoid double-free of OTP NVMEM device] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 (7.3-rc6) +CVE-2026-98833 [mtd: core: call _get_device() with the master MTD] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/12b31d1acd20b3185bb5f0748db0cf6874c8e9d1 (7.3-rc6) +CVE-2026-98831 [of/overlay: don't leak fragment references when changeset init fails] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/1d62f0f2bc7edb12ed09f71203df0e47fa4efca4 (7.3-rc6) +CVE-2026-98830 [wifi: wfx: validate MIB read length before copying to caller] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ce67ebe9d8629776ce38e6995ae72fb903c828db (7.3-rc6) +CVE-2026-98829 [wifi: mac80211: drop oversized fragments to avoid extra_len overflow] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/5e4f3509793b4db2c0835340224743db680e861f (7.3-rc6) +CVE-2026-98828 [wifi: ath9k: reject short WMI command responses] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/93ce8ea70451e800601bc9444aa33043de15d67b (7.3-rc6) +CVE-2026-98827 [wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/aeaca27c1db3106967ffbb2b517d98c835f6d500 (7.3-rc6) +CVE-2026-98826 [rtc: ac100: Fix clock provider use-after-free on probe failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/fcf0b58e976e83adf246b014518e49c662b96f5e (7.3-rc6) +CVE-2026-98825 [rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ac41b05d15db3134e839148290d67415ee0bdb58 (7.3-rc6) +CVE-2026-98824 [wifi: mac80211: validate TX status rate metadata] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/6bdcdb31318c10e6369cff8e5b32c37397e98091 (7.3-rc6) +CVE-2026-98823 [wifi: cfg80211: preserve hidden-group beacon IE ownership] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/cc45f313d85533d647ce619326302aad6f797c14 (7.3-rc6) +CVE-2026-98822 [wifi: mac80211: prevent AP VLAN tx from other interfaces] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/7f93ca31f7fd9b42e7d692f59514436d448ac908 (7.3-rc6) +CVE-2026-98820 [blk-mq: set RQF_USE_SCHED when the operation is known] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/ab6c756f28c741d704a7c3e04814bfc3adf6f818 (7.3-rc6) +CVE-2026-98819 [Bluetooth: btintel: validate DDC record lengths] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/c9c15d4d8956df8c564f7c210e4dc5b9b820d97a (7.3-rc6) +CVE-2026-98818 [mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/af2fb3ee6679b517e2fdbd3ba16ec276a8b74312 (7.3-rc6) +CVE-2026-98816 [bpf: Fix overflow of jump offset in constant blinding] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/ad139384ecddb6f3e7e3c3c12765aafae0e39670 (7.3-rc6) +CVE-2026-98815 [nvme: fix cdev lifetime] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/9952f3882ecba709092379b71e02b09762b26f96 (7.3-rc1) +CVE-2026-98814 [nvme: fix command effects log lifetime for multipath heads] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/72ece656abd4de8645a421fb482d7a11e6533a45 (7.3-rc6) +CVE-2026-98813 [bpf: Hold map BTF for the memory allocator destructor record] + - linux 7.2.10-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/ab39974240a0cff765f3bb9cce81d8001ffdb144 (7.3-rc6) +CVE-2026-98812 [net/mctp: publish the mctp_dev only after it is initialised] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/aadf655e8ea9a8ffa24bb8d69f504572e8d18181 (7.3-rc6) +CVE-2026-98811 [net/sched: cls_api: reclaim an empty proto on the error path] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/0bb8eab29b55045281a4963d4557f2776cdf8cfa (7.3-rc6) +CVE-2026-98810 [wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/6f63e919fe1e335b8abcb3a28bfd4804a98d875a (7.3-rc6) +CVE-2026-98809 [Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/b1f24c1ab52345e810c42a1a81286cb5a7c92252 (7.3-rc6) +CVE-2026-98808 [net: systemport: Fix buffer overflow in bcm_sysport_get_stats()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/eb7b84af0ec5c71b4920e999611b466b3784496c (7.3-rc6) +CVE-2026-98807 [net/mlx5: Fix slab-out-of-bounds when handling team device events] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/04c824940d52871c49866a4ac67b504146f7cf35 (7.3-rc6) +CVE-2026-98806 [octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/056994563935e049093f100efaad7e63ad113814 (7.3-rc6) +CVE-2026-98805 [tipc: prevent GCM nonce reuse on peer key changes] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/512ccd3d0e91e791fb37442aa0a2599aca19783d (7.3-rc6) +CVE-2026-98803 [net: stmmac: fix rx Scatter-Gather support] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/88095728511e0df9c89528944f5a1762ad298983 (7.3-rc6) +CVE-2026-98802 [seg6: ensure packet data is writable before modifying SRH and IPv6 DA] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/8ae3f4067ba4ae3a15581392f6dac422e3d3def0 (7.3-rc6) +CVE-2026-98801 [net: restrict SO_RESERVE_MEM to TCP sockets and cap max value] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/37e02c42a00be692c06343e11779aadc45f45971 (7.3-rc6) +CVE-2026-98800 [bpf: Wait for an RCU tasks grace period before freeing trampoline progs] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/0fb5751a6e411b1b466c06e50021818d9391df98 (7.3-rc6) +CVE-2026-98799 [bpf: Skip detached progs in trampoline images that are still in use] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/17637e1a581a22466ac3620a91e099683ff9cc6f (7.3-rc6) +CVE-2026-98798 [net: bcmgenet: fix NULL dereference in set_coalesce before first open] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/19419faf58dfe5bcc8a9e60e622976c5f8e3ddc1 (7.3-rc6) +CVE-2026-98797 [net: cap skb->queue_mapping when the tx queue is picked] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d (7.3-rc6) +CVE-2026-98796 [net: ethernet: mtk_eth_soc: allocate dummy netdev sooner] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b (7.3-rc6) +CVE-2026-98795 [net: sparx5: skip ptp deinit if init was skipped] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/0d2c49915bc3aea4521cda5e4d42f24f63b94585 (7.3-rc6) +CVE-2026-98794 [ipvs: filter some flags received in the backup server] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f96e91748f6304668fe647e686d199d7207d36f1 (7.3-rc6) +CVE-2026-98793 [netfilter: bpf: reject invalid NAT manipulation types] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/16d464013ec2267b00a83f4bfbb97b3ecc63bfa7 (7.3-rc6) +CVE-2026-98792 [netfilter: flowtable: generalize pending status bit] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/7c549fb7eecd01fdba7c0d12c01da876ef8a3214 (7.3-rc6) +CVE-2026-98790 [perf: Fix race between perf_event_exit_task() and perf_pending_task()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ffb684f2aa141eeb0caa6308422e7e05d1ded7c4 (7.3-rc6) +CVE-2026-98789 [bpf: Fix objects stuck in free_by_rcu_ttrace] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/fbd97dd1d3ce32d32fb7be86acc3fdb7c04fa043 (7.3-rc6) +CVE-2026-98788 [futex: Fix private hash use-after-free on resize] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/f35e3b5784221654f9cdbd6222275a7fa203f6c3 (7.3-rc6) +CVE-2026-98786 [drm/amd/display: guard dc_sink dereferences in MST mode validation] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/217f64f348c90cba62164e7ff38e0ccf78a5ca09 (7.3-rc6) +CVE-2026-98785 [drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/015e72cde567d2450e282c2790773463156b2d0a (7.3-rc6) +CVE-2026-98784 [drm/amdgpu/gfx6: fix firmware leak on teardown] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/cc172e177795c5f87bc2d71768d077e1c10633e8 (7.3-rc6) +CVE-2026-98783 [drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/bce7698e2e6565bb765bd0522337f29f5f312624 (7.3-rc6) +CVE-2026-98782 [drm/mediatek: Fix ovl adaptor platform device leak] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/048739be3e9cacae5301b68245668002fe6f0ce5 (7.3-rc6) +CVE-2026-98781 [drm/mediatek: Fix pdev reference leak in mtk_drm_bind()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/3753e34b73fcbe2a2edbe984614a008a261697ef (7.3-rc6) +CVE-2026-98780 [drm/amdgpu: fix IP instance memory leak on kobject add failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f5a5add3605935163dd0f75749b6a7869e9765af (7.3-rc6) +CVE-2026-98779 [drm/amdgpu: fix ACP MFD device leak on init failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f0013046151b7467e62c471c1c83d63ea255799c (7.3-rc6) +CVE-2026-98778 [binder: fix is_failure flag for superseded transaction cleanup] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/22c135635fdd9816c0ef140d6de7b2e4fdf73e89 (7.3-rc6) +CVE-2026-98777 [binder: fix leaked fd fixups on TF_UPDATE_TXN supersede] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/c4c02084d6687d5cd5edccaf52cc45e5160f1184 (7.3-rc6) +CVE-2026-98775 [nitro_enclaves: fix use-after-free on SLOT_ALLOC failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/9bc184a2eda8b773c88ecbff934001ad649b9cc1 (7.3-rc6) +CVE-2026-98773 [USB: cdc-acm: skip URB restart in port_shutdown if disconnected] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/dc614d6bc991740d41d5a99ac7765c4b675dda88 (7.3-rc6) +CVE-2026-98772 [USB: serial: fix port tear down use-after-free] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/33c920f7c5952dfc42d1b8ea6efe16b1f0bb0c5b (7.3-rc6) +CVE-2026-98771 [usb: storage: sierra_ms: reject short SWoC info transfers] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/8a0200d14acd9db388b85cd016e68a4e60d900ec (7.3-rc6) +CVE-2026-98770 [usb: gadget: midi2: Fix the jack descriptor array sizes] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/310c2d4608d8c1a2baa57db1dfd319c5c40cf4a1 (7.3-rc6) +CVE-2026-98769 [usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/9062d50e75c24dc7911be05c9b1719b3b256af15 (7.3-rc6) +CVE-2026-98768 [usb: typec: anx7411 - stop the IRQ before destroying the workqueue] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/469600d5d292b1482c90dd6853555821d11b8c5f (7.3-rc6) +CVE-2026-98767 [usb: dwc3: gadget: fix IRQ storm on invalid event buffer count] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/1ff77cbefe5a653ea12874c213ea4bd0d72c1067 (7.3-rc6) +CVE-2026-98766 [usb: gadget: aspeed-vhub: cancel wake work on device removal] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/20388c8d1d74c203fec8194c45cd31afdfab934e (7.3-rc6) +CVE-2026-98765 [USB: gadget: dummy-hcd: Fix wait for outstanding request completions] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/b263ff9b0fc5c1f371d65c4eb196b31263d039ff (7.3-rc6) +CVE-2026-98764 [usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/9cd072788c76595529eb38f42bf94d23852f8534 (7.3-rc6) +CVE-2026-98763 [usb: core: clear both ep_in and ep_out for non-ep0 control endpoints] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/0e8baa78d872f2db440d8b9ded946ab8dceb89eb (7.3-rc6) +CVE-2026-98762 [USB: dwc2: shut down wakeup timer before freeing HCD state] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/fd772af9512cdecb83de34a461801533828e77fd (7.3-rc6) +CVE-2026-98761 [usb: typec: tcpm: recover after failure to start the frs ams] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/90156585765b29304f07b0e4a1c56a969876fcfc (7.3-rc6) +CVE-2026-98760 [usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/c4b27b3605788bbf9e4251f3cd4ab94645ab036f (7.3-rc6) +CVE-2026-98758 [usb: typec: ucsi: glink: fix use-after-free of ucsi on remove] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/63b269ec537dc0fd26d0bd64872c26860d108c9d (7.3-rc6) +CVE-2026-98757 [usb: cdns3: fix use-after-free in cdns3_gadget_exit()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ebe9b68c396792c15d0ac690d592e449e74ed804 (7.3-rc6) +CVE-2026-98756 [usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/e5052f2c5c73c1dcca42bafc0bc737af2b2af059 (7.3-rc6) +CVE-2026-98755 [tty: vcc: zero-initialize control packet in vcc_send_ctl()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/1f71f565e3585da1098ff19ca3c24687dab59185 (7.3-rc6) +CVE-2026-98754 [tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/03b49c991abb8d021ca6fe51cd173447236b0552 (7.3-rc6) +CVE-2026-98753 [tty: tty_port: restore TTY_IO_ERROR on activation failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/56964f6a31238fb41d5830bb42520c5b10ff7d8f (7.3-rc6) +CVE-2026-98752 [tty: port: fix tty_port_tty_vhangup() race] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/b48820de8c1a596c5b99775524dfce73c6576c5d (7.3-rc6) +CVE-2026-98751 [tty: abort break signalling on hangup] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/845a2737e0f5ffe5ca8d38de556012b0c9472cdd (7.3-rc6) +CVE-2026-98750 [tty: fix saved termios reset race] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/8df07fe93573e9e548d6645273e9bcb6eb74059e (7.3-rc6) +CVE-2026-98749 [tty: serial: max3100: shut down timer before freeing port] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/db0949bbd06db0a75b4b1076f1e25194be7d956a (7.3-rc6) +CVE-2026-98748 [serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/189b9dc8c96ec9486482f27c1372b04a7152175e (7.3-rc6) +CVE-2026-98747 [serial: core: fix NULL pointer dereference in serial_core_unregister_port()] + - linux 7.2.10-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/499485a67fbacf4d9afbdb43522388c64f853428 (7.3-rc6) +CVE-2026-98746 [serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/98401cf912fe8a081ef8e500c421b6d957b55a99 (7.3-rc6) +CVE-2026-98745 [arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/e060d9069b49fe55f38057dfe592068014652671 (7.3-rc6) +CVE-2026-98744 [ASoC: codecs: max98363: fix uninitialized stream_config->type] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/bcd61aa247c28b721ac21dda6e4135f75a2de29f (7.3-rc6) +CVE-2026-98743 [ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/174d160884199cad97413f33fe1b56027dc0d3e1 (7.3-rc6) +CVE-2026-98742 [ALSA: seq: Serialize compat port-info ioctls] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/95b2e0361c88753afa030c10698be0a1a5b67650 (7.3-rc6) +CVE-2026-98741 [ALSA: ua101: reject mismatched capture/playback packet sizes] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/86f86e6fdedc33c5b8d38b9208b350f8accf57ee (7.3-rc6) +CVE-2026-98740 [EDAC/altera: Drop __init from ECC setup paths for re-probe safety] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/b62a264163ca51bee04785c581344751812395df (7.3-rc6) +CVE-2026-98739 [Bluetooth: RFCOMM: Fix initial port reference race] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2d696c1ed3468dcb62578a3911e687110d463520 (7.3-rc6) +CVE-2026-98738 [Bluetooth: Serialize SMP remote OOB data access] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/81a2345f1984f0b36d3226571bc196316a01b648 (7.3-rc6) +CVE-2026-98737 [Bluetooth: hci_sync: Fix inquiry cache use-after-free] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/8ed67535fdff40ca652bcd4ac7da68d11d01bd34 (7.3-rc6) +CVE-2026-98736 [Bluetooth: hci_conn: Lock parent access during enhanced SCO setup] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/024e05f73a4c1263d031614bc36700ec135eecb4 (7.3-rc6) +CVE-2026-98735 [Bluetooth: hci_core: Serialize ACL scheduling with channel deletion] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f4845ab191a4f686a5da481fbba90ed73bb693b0 (7.3-rc6) +CVE-2026-98734 [Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/848a7a91c7f03675d3bd8db6f7721cbf9cb50e21 (7.3-rc6) +CVE-2026-98733 [Bluetooth: hci_core: Serialize fragmented ISO packet queueing] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/1a572db43c057566771b485598ad2e66cb390821 (7.3-rc6) +CVE-2026-98732 [Bluetooth: btintel: fix buffer over-read in btintel_hw_error()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/40eb4b18ad167b63644c27fa67a7400ba050379a (7.3-rc6) +CVE-2026-98726 [nvme-multipath: fix underflow in ANA log bounds checks] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/63fa2d9c9c37020bd2703fe2a6a38027b5abeb15 (7.3-rc6) +CVE-2026-98725 [nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/fa6778e030bed9841ddcdf96bc7018da9ac03562 (7.3-rc6) +CVE-2026-98722 [mtd: block2mtd: Fix divide error when erase_size is zero] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/b5965c4221165045e19736794ca5f48ae3d67142 (7.3-rc6) +CVE-2026-98721 [mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/21f027016b1290d13c30b198ae7a00e6b3d1d5a5 (7.3-rc6) +CVE-2026-98720 [KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2abb25273c82061dd4670690c81c319c03740bf6 (7.3-rc6) +CVE-2026-98717 [KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/b6249c1d5665098c8bf12f8d3e4712bf04c775bc (7.3-rc6) +CVE-2026-98716 [KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/9e06bbb9ade7cdf28d4a3b5b14e5812881c8df85 (7.3-rc6) +CVE-2026-98715 [KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/60d93c27859fb3ec5b5a689e24de303f166477d0 (7.3-rc6) +CVE-2026-98714 [KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/e27fc915c8f575ab5630e27d97465c2077d4b9d1 (7.3-rc6) +CVE-2026-98711 [wifi: cw1200: fix TX padding OOB read leaking heap data to device] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/7c1611780823b76219cb1478db53dfd890c4a9a2 (7.3-rc6) +CVE-2026-98710 [wifi: iwlegacy: 3945: free EEPROM data on remove] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f8ebe286394c0bbb4a6dbacb182a34ab6376922d (7.3-rc6) +CVE-2026-98709 [wifi: mac80211: count only matching reservations in reserved switch] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/437f3727b4fd715266c296435c116288f82666fd (7.3-rc6) +CVE-2026-98708 [wifi: mac80211: keep paired old chanctx alive] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/3412e9a800786d1dec4a58367db1cba275e7ef11 (7.3-rc6) +CVE-2026-98707 [wifi: mac80211: shut down RX BA session timer on teardown] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/e588e83e5c7a0f6d7a77dbbb58927c8c8cfd598e (7.3-rc6) +CVE-2026-98706 [wifi: mac80211: drain PS delivery work during station teardown] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/67a9e80c3ca20c9044cd6ee72cd6278dd19b5023 (7.3-rc6) +CVE-2026-98705 [wifi: mac80211: account proxy paths against the mesh path limit] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/a5f35d4b112af1415ff06bd501c8cc26cc08aa8b (7.3-rc6) +CVE-2026-98704 [wifi: mac80211: keep fallback association elements alive] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/a10a2f80476d166fd81c361ec0319493671b694e (7.3-rc6) +CVE-2026-98703 [wifi: mac80211: minstrel_ht: validate fixed rate index] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/15fb9e3cea55fbc378261ce35a32b0f8828f0000 (7.3-rc6) +CVE-2026-98701 [wifi: mac80211: release mesh path quota on failed additions] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/7325a44474f20c1393a1c114c6811abce6ddfaf4 (7.3-rc6) +CVE-2026-98700 [wifi: mac80211: set info->band for 802.3 encap offload frames] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/4febc02cd02f021f2b6d0768332be643ef14a12d (7.3-rc6) +CVE-2026-98699 [wifi: mac80211: fix mesh fast xmit path deletion UAF] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/ee3aadc43ea69d98f666431e787137ac0badbb85 (7.3-rc6) +CVE-2026-98698 [wifi: mac80211: handle empty FILS association request payload] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/5bfd4b0b40b79781d900cb2f7da0685070f53c67 (7.3-rc6) +CVE-2026-98697 [USB: serial: fix dynamic id driver deregistration race] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/63594e8ffe097bc0b7639936f33799a7653dded2 (7.3-rc6) +CVE-2026-98696 [USB: serial: fix driver deregistration order] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/646e5b28b4fdbc1b828a2398d6ced2c1dd308a46 (7.3-rc6) +CVE-2026-98695 [USB: serial: fix ioctl hangup race] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/ae0e61d95677efa778379853e495d748e6efbf95 (7.3-rc6) +CVE-2026-98694 [thunderbolt: Fix KASAN reported use-after-free when request is canceled] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/a02188ddc24b7872f0c5e0c5873f827318717803 (7.3-rc6) +CVE-2026-98692 [thunderbolt: Make the DP tunnel activation callback mandatory] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/12f5d8b85a66a0ac08d082517d92ce136f8c0d42 (7.3-rc6) +CVE-2026-98688 [thunderbolt: Fix NULL dereference in tb_remove_work()] + - linux 7.2.10-1 + [trixie] - linux <not-affected> (Vulnerable code not present) + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/4310c6b8e75d6a47f7548e5948fbe6318aa4440a (7.3-rc6) +CVE-2026-98687 [thunderbolt: Reject oversized XDomain properties responses] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/80756e263846ab694984e749e8c626897331438f (7.3-rc6) +CVE-2026-98686 [smb: client: discard post-EOF pagecache when extending a file via zero range] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/da4fe97fb6c730d9c94a115c7bfa6f98e0d578d0 (7.3-rc6) +CVE-2026-98685 [smb: client: discard post-EOF pagecache when extending a file via clone range] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/4721587f96cb8de8164f3fd203093a0875560999 (7.3-rc6) +CVE-2026-98684 [smb: client: flush and commit data before querying allocated ranges] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/aa994489bd835547c191827acc460192e147032d (7.3-rc6) +CVE-2026-98683 [smb: client: flush dirty data before zeroing a range] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/8f8d32c1044f70e46e87550e039a15ff20a4b21c (7.3-rc6) +CVE-2026-98682 [smb: client: drain and invalidate before server-side copy/clone] + - linux 7.2.10-1 + NOTE: https://git.kernel.org/linus/c9b1194e8ec99d95db25db45edd2fbf690f043ab (7.3-rc6) +CVE-2026-98681 [smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/19465a9aeb664f1d710d0d22c07c31bfb7c85446 (7.3-rc6) +CVE-2026-98679 [iio: accel: kxcjk-1013: reject duplicate event disable] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/dd30c10ff60d2b30386c23bb7c61cc97f2385c97 (7.3-rc6) +CVE-2026-98677 [iio: adc: ad_sigma_delta: fix use-after-free on unbind] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/9ee8306121495d2a25aa5d1bfd519f2748786b83 (7.3-rc6) +CVE-2026-98674 [iio: adc: adi-axi-adc: Initialize state mutex] + - linux 7.2.10-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/549b71ce050637dd32678371ad76c445a2f8c9aa (7.3-rc6) +CVE-2026-98672 [iio: adc: stm32-adc: fix possible division by zero in processed channel] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/c5de6a6f855fdcf1e0ea549fb227a316db51c405 (7.3-rc6) +CVE-2026-98671 [iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2cdc7ef31827db4fbc6283750420639569e1f0e9 (7.3-rc6) +CVE-2026-98670 [iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/0f3f427076240e75ff265e61645627a71ca4918c (7.3-rc6) +CVE-2026-98669 [iio: buffer: serialize buffer teardown with mode claims] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/84bb0fc46ccf6a545b8fdf57cda83770186ed8dd (7.3-rc6) +CVE-2026-98668 [iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/5330036bc68d23672bfcc16c60c54701ae123083 (7.3-rc6) +CVE-2026-98666 [iio: gyro: adis16136: fix unprotected debugfs reads] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2b498df75d6c29aa3e760127ae0f0003df598b53 (7.3-rc6) +CVE-2026-98665 [iio: health: max30102: fix NULL dereference in interrupt handler] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/f0ea4824deebf21dacfbe397c4b0a5fd3e745a8d (7.3-rc6) +CVE-2026-98664 [iio: imu: adis16400: fix unprotected debugfs reads] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/d94787287a113a1326211647d5e0deed1e9de105 (7.3-rc6) +CVE-2026-98663 [iio: imu: adis16480: fix unprotected debugfs reads] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/e1dea54496f90a62318cf4eeaa1e9ef8316e92b6 (7.3-rc6) +CVE-2026-98662 [iio: light: gp2ap020a00f: drain irq_work after free_irq] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/63213927b141085b6c8719b8037dab3074b7e0fe (7.3-rc6) +CVE-2026-98661 [iio: light: rohm-bu27034: Fix infinite delay on error] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + [bookworm] - linux <not-affected> (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/8065a6c02f629187131f3136bedb26f9080e3cca (7.3-rc6) +CVE-2026-98660 [iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/56c423b233b214182c58c99861899327b45b0d6c (7.3-rc6) +CVE-2026-98657 [iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/4daa9ca557b4b98ae1ad38a6d1deaa3e31eb8edf (7.3-rc6) +CVE-2026-98656 [iio: trigger: cancel reenable_work before freeing trigger] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/2a57b9246cecd5dd797a42eb310d6c8816f26d9e (7.3-rc6) +CVE-2026-98655 [perf: Require kernel access for text poke events] + - linux 7.2.10-1 + [trixie] - linux 6.12.113-1 + NOTE: https://git.kernel.org/linus/357e8a77a501d96c9517f01f4a211eed5e9c9184 (7.3-rc6) CVE-2026-98654 [drm/amd/display: Atomize IRQ register read/modify/write ops] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/63e19ef3ddab806c472748c825f4dc88dcd994e8 (7.3-rc4) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/06571468f83a031f63f38cf19ffcd97164ddebb4 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/06571468f83a031f63f38cf19ffcd97164ddebb4 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
