[Git][security-tracker-team/security-tracker][master] Merge Linux CVEs from kernel-sec
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Oct 23 16:54:40 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
89d49f4f by Salvatore Bonaccorso at 2026-10-23T17:52:39+02:00
Merge Linux CVEs from kernel-sec
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,588 @@
+CVE-2026-99079 [net/mlx5e: Prevent stale XSK buffer release on refill retry]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e01620844c5c88b6fcf819d171df8e3976a0e76f (7.3-rc2)
+CVE-2026-99078 [net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/63811edf512584c946e5e96b100e9e280703bbb5 (7.3-rc2)
+CVE-2026-99075 [rust_binder: reschedule node refcount update on thread exit]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2a74ccd1bcc170e66525f34e9de8652b57e2cf3d (7.3-rc6)
+CVE-2026-99073 [ipv4: stop exception dump when nexthop group shrinks]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2 (7.3-rc7)
+CVE-2026-99069 [Input: ati_remote2 - fix type confusion in device attribute handlers]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/f321cc430c49b6c1be0d53f2ef19d8342d8029cc (7.3-rc7)
+CVE-2026-99068 [ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/593d46fc6af9a0178a46e77d6d24b20d2314165f (7.3-rc7)
+CVE-2026-99066 [can: dev: init_can_skb(): restore skb header initialization]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0a04c0cb8606ff88399489d03ef255afe90d0d5f (7.3-rc7)
+CVE-2026-99065 [cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2 (7.3-rc7)
+CVE-2026-99064 [cipso: adjust cached option offsets when removing CIPSO]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6d25ffca055a77787c21a36b66c253f76239411b (7.3-rc7)
+CVE-2026-99062 [vsock/virtio: account only unread bytes in read_skb()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a463f55c791b96cfd12df8b10ea737d45c80bb18 (7.3-rc7)
+CVE-2026-99060 [wifi: mt76: mt7603: initialize global station WCID]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/456de496b53ae73e6e3020fec815dbdc88aa7c07 (7.3-rc7)
+CVE-2026-99055 [tcp: reject net_iov in zerocopy receive mapping hints]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/8b1f0af1fd5fd113432233ed8a3862ee7c30a84f (7.3-rc7)
+CVE-2026-99051 [fsverity: RCU-delay the freeing of struct fsverity_info]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e58c3805ed325fe2d4ae2dd467c0486cc860b733 (7.3-rc7)
+CVE-2026-99050 [gpio: mpsse: fix race when arming the IRQ poll worker]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7efa1a1953cd6b20b23a3524d5b4b81789c6ef25 (7.3-rc7)
+CVE-2026-99048 [gve: fix napi_disable deadlock when attempting to disable XSK pools]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0cb6939a4dfefa822007b7a71986e06bc4f61f54 (7.3-rc7)
+CVE-2026-99047 [gve: fix XSK buffer leak when rings are stopped]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/73670ddb91a4d22e1deb3efd962242de1ec48e90 (7.3-rc7)
+CVE-2026-99046 [gve: fix XSK buffer leak on error descriptor]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e (7.3-rc7)
+CVE-2026-99042 [io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/aa5d5f8e502318e783545ba5d04bb40130b83e20 (7.3-rc7)
+CVE-2026-99030 [net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/ab9414ed70bd783e902a85c350620dee269bcb2b (7.3-rc7)
+CVE-2026-99029 [net: sparx5: free the matchall entry on destroy]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2b82e16d6084cbc651e3c902198f1945408ee1a5 (7.3-rc7)
+CVE-2026-99023 [power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0d6c5794fd633427f0d4ad8b51d94061295649da (7.3-rc7)
+CVE-2026-99020 [regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2f15518682c779b1014552cb2ccb4a2052f85f27 (7.3-rc7)
+CVE-2026-99018 [riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4d0697f192975dab5985e921989be1d85cf580e9 (7.3-rc7)
+CVE-2026-99017 [riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/298510bbc7c3017c0faf481c6ea66f1065b657b4 (7.3-rc7)
+CVE-2026-99016 [riscv: futex: untag the user pointer before the atomic access]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/405290be962b32eec842776fbe3bdf81f15b1676 (7.3-rc7)
+CVE-2026-99013 [Bluetooth: ISO: Reject concurrent BIS listener setup]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/555ff78fa719f50ff4cdbdb40aa1acc6e8e327d3 (7.3-rc7)
+CVE-2026-99011 [Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/816fb1590a4c8cf8d05cd076057616be02e276f0 (7.3-rc7)
+CVE-2026-99004 [drm/imagination: Size page table preallocation by device address]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/789f290b2e81d42820bddcb4010ffbc2ae2ded54 (7.3-rc7)
+CVE-2026-99003 [drm/panthor: validate userspace queue count against initialized firmware slot count]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/ec86c43dcfff68eab4db9bdafcd3e2b16e342e18 (7.3-rc7)
+CVE-2026-99001 [drm/xe/i2c: cancel the client work on remove]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/611857adc9e7b0ee1239a0baf38498922ca5a12e (7.3-rc7)
+CVE-2026-99000 [drm/xe: Fix shrinker accounting double-subtraction on nested external pins]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/83d5acca1f4f6132038ea88c72c5844f62e42d44 (7.3-rc7)
+CVE-2026-98998 [drm/bridge: th1520-dw-hdmi: Fix remove() callback]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/01c83795d50ccdb441f60e89ff50767cb2f6045a (7.3-rc7)
+CVE-2026-98997 [drm/amdgpu/userq: only accept doorbell BOs as queue doorbell]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7f7c88dbf4d543f6703e53bdeed380e886733167 (7.3-rc7)
+CVE-2026-98995 [namespace: reset the old parent's ->overmount in mnt_change_mountpoint()]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/476ef286a7a5db8bda51325dc0c45887b4d99d9a (7.3-rc7)
+CVE-2026-98994 [statmount: read the parent of an unmounted mount under mount_lock]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/bb46094057520304073130920c223451c2a694a7 (7.3-rc7)
+CVE-2026-98991 [namespace: queue a mount only once for mount notifications]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/bd2feb7796b6585938a4241e7b7c4148a6f7b762 (7.3-rc7)
+CVE-2026-98988 [namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0febe278ec45b1ccdbe9bd5ff1ba365d8fd55e2a (7.3-rc7)
+CVE-2026-98987 [namespace: look at the topmost mount for a mount namespace file]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/8714b44adac7b10506e1db3ef1710689751f0f10 (7.3-rc7)
+CVE-2026-98986 [namespace: remove the fsnotify marks of a mount namespace in process context]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/1a116222acdcc1bc1a8350727ae6f28907d44594 (7.3-rc7)
+CVE-2026-98982 [namespace: don't let a pseudo dentry become the root of a mount]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b138e16fb1e81376cea89f727dda7bfccd140de4 (7.3-rc7)
+CVE-2026-98976 [namespace: keep the lock on a mount that a propagated copy is moved beneath]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/d74d66aa708ccf2bc0b1e265a83fed0f2308d5c4 (7.3-rc7)
+CVE-2026-98973 [drm/bridge: Fix unlocked list_del in drm_bridge_add()]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b62e3db8cdc1680e1c3390591e872f485148541a (7.3-rc7)
+CVE-2026-98965 [ice: Restore Ordered MMIO Writes for Tx Doorbells]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7a579dec8423bba7bec96fcfcb2e30838b0858ee (7.3-rc7)
+CVE-2026-98963 [btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/80a8dbb30d2b00b9c671b02bd73f700f6d20100f (7.3-rc7)
+CVE-2026-98962 [btrfs: free iov when btrfs_uring_read_extent() fails]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a8ea92830b3e0e163d4e829bdcb17ca83c0f951c (7.3-rc7)
+CVE-2026-98961 [btrfs: unlock inode and extent in caller when io_uring read extent fails]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b6e8add5d79d1f6f819a054c833bab452bd7365d (7.3-rc7)
+CVE-2026-98953 [devlink: fix devlink_rel reference leak when notify work is pending]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/c5381ae1cd1481cc431c2bd79460472c6f1d3ce3 (7.3-rc7)
+CVE-2026-98952 [pfcp: make sure the SEID is linear before reading it]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/23609bce9e1de525d1d0e73fc68c6e7971d0b49e (7.3-rc7)
+CVE-2026-98949 [drm/imagination: Fix reference and vm_bo handling in remap()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/196d4d10c1b33ae176685ff42a9994a5952b1d0f (7.3-rc7)
+CVE-2026-98948 [mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7ea07afb230f1342ab0f9365edd0aae137f425d3 (7.3-rc7)
+CVE-2026-99081 [bnxt_en: fix DMA mapping length for padded small packets]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/a51d233ccd4889aadb71dace863525cc2b00271e (7.3-rc7)
+CVE-2026-99080 [fs: Free any excess xarray nodes in clear_inode()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/ee3f011250104129893d8e9599147e457d4d7280 (7.3-rc1)
+CVE-2026-99077 [ipv4: udp: Create exceptions before socket matching]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/4c3499f79f8c7e8561266bcc220a18538cec0458 (7.3-rc2)
+CVE-2026-99076 [ipv6: udp: Create exceptions before socket matching]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/ac76cab50e899a7346408b8d3c3a4192c2eefb9f (7.3-rc2)
+CVE-2026-99074 [ipv4: stop PMTU walk when nexthop group shrinks]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/6619e01855e65ef35723685a557e3eb106f4ecf5 (7.3-rc7)
+CVE-2026-99072 [ipv4: stop route notification sizing when nexthop group shrinks]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/d3daa33c7af92e38f2274bbd2576f58bfbaf89e6 (7.3-rc7)
+CVE-2026-99071 [ipv4: do not warn on route notification size race]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/e02a5b6588161673ef75a4bc5cdfb62bd493374d (7.3-rc7)
+CVE-2026-99070 [ipv6: do not warn on route notification size race]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/c97426ec649d99596d8969e1a052c16b14b7b485 (7.3-rc7)
+CVE-2026-99067 [btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/1fd742c7479961da6d0bb794ef8ac6b7b9442847 (7.3-rc7)
+CVE-2026-99063 [dm ioctl: don't let data_start run past the buffer]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/9b3fcf519d370df94a56f3b272d9eddffffa5be8 (7.3-rc7)
+CVE-2026-99061 [wifi: brcmfmac: fix P2P device removal race in brcmf_detach()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/08a3f02fea636e97a7422d1512f76dacdb5b0887 (7.3-rc7)
+CVE-2026-99059 [wireguard: noise: reject response consumption after intermediate initiation]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/d0305f8d90029556260c6824b61c493c424eba9e (7.3-rc7)
+CVE-2026-99058 [workqueue: Fix NULL current_pwq deref in chained work check]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/980db94e3eeefdd8a1c46f86412c33a7f7806f51 (7.3-rc7)
+CVE-2026-99057 [xen/netfront: don't leak the skb when xennet_fill_frags() fails]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/93ccaf1c26e2133396173b76a071e59024daa622 (7.3-rc7)
+CVE-2026-99056 [strparser: make sure __strp_recv isn't running before tearing down the parser]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/0984ebc631792acf8fff105112ee74a6b8f1efcc (7.3-rc7)
+CVE-2026-99054 [tipc: destroy topsrv workqueues before closing connections]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/3acdd44385bc7e2e57605e073691ce69cc5a960d (7.3-rc7)
+CVE-2026-99053 [tipc: hold a reference to nodes found by link name]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/17e73bae400f6a434dc006e3bee92c94cf781954 (7.3-rc7)
+CVE-2026-99052 [selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/28b7260548af3d35773477993ad4e4de41578dd7 (7.3-rc7)
+CVE-2026-99049 [gpio: xilinx: fix runtime PM leak on request error path]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/ff82fc3a4a1d417dee1229681cc5285986edb1fa (7.3-rc7)
+CVE-2026-99045 [ibmveth: h_free logical LAN on open-fail after register]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/af0524bf4ce1a4cbd2946aa81751582951cfcab5 (7.3-rc7)
+CVE-2026-99044 [ice: fix use-after-free in dynamic port cleanup]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff (7.3-rc7)
+CVE-2026-99043 [ice: fix metadata_dst refcount handling on representor teardown]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/58858b8f14803a7eeac297b3ce20f3b21bf2ff66 (7.3-rc7)
+CVE-2026-99041 [ip6_gre: remove obsolete ERSPAN PMTU update]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/8bc60db48e8cba35488bbd6e1f94aa990afa275a (7.3-rc7)
+CVE-2026-99040 [KEYS: Fix add_key() race with keyring restriction]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/dd3ea3fcba7c75493760cdbccd35f029597e8d5e (7.3-rc7)
+CVE-2026-99039 [memstick: core: wait for request completion before freeing card]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582 (7.3-rc7)
+CVE-2026-99038 [memstick: rtsx_usb_ms: complete requests after eject instead of dropping them]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/c96ca94425b076dc398d929366e378d1e22ec794 (7.3-rc7)
+CVE-2026-99037 [dm-crypt: reject the lmk IV mode with AEAD ciphers]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/3195e0daf590683992edb4eed32269e569e04924 (7.3-rc7)
+CVE-2026-99036 [dm: fix reading free memory in do_resume]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/c9417c1c5269e2bd0570fbe53e4ec03a8d31f008 (7.3-rc7)
+CVE-2026-99035 [mmc: mtk-sd: Cancel request timeout work on remove]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/b38af5386a74416e898955443f2e26547b358cb2 (7.3-rc7)
+CVE-2026-99034 [mmc: sdhci-sprd: disable runtime PM on remove]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/e1c6c10a6a70a69e29b04fcc1ebe4b9bcbc7a49a (7.3-rc7)
+CVE-2026-99033 [net/packet: guard the ll header push in packet_rcv_spkt()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/28bc1ef699610ee09ce3d46a00552f5a0a0144bd (7.3-rc7)
+CVE-2026-99032 [net/smc: protect clcsock lifetime in smc_getname]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/64a6b36b0e1855288080bc5f89769f27d6dc03c8 (7.3-rc7)
+CVE-2026-99031 [net: bridge: avoid recursive multicast port cleanup]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/5158353121bae4f552cb677ce8c5c3ef52f93a0d (7.3-rc7)
+CVE-2026-99028 [net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/bcf2573a68a808a5b54cadafa72b6672e662c2bf (7.3-rc7)
+CVE-2026-99027 [net: team: stop reusing skb after queue override]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/b7454f1940c5e6d92e753853c476a769e452f30a (7.3-rc7)
+CVE-2026-99026 [net: team: free skb when broadcast has no txable port]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/489114c9ecae44e523361a4b3e610ee5ebd9189c (7.3-rc7)
+CVE-2026-99025 [openvswitch: fix soft lockup in the netlink flow dump]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320 (7.3-rc7)
+CVE-2026-99024 [optee: register TEE devices only once fully initialized]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/c108feca0a096f8db25d1b69130035025e9e936d (7.3-rc7)
+CVE-2026-99022 [regulator: ltc3676: don't read the write-only HRST and CLIRQ registers]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/28c2388ee24cdbefbcc458fa41ef7bffaaa1cc83 (7.3-rc7)
+CVE-2026-99021 [regulator: of: fill in supply names in of_regulator_bulk_get_all()]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5 (7.3-rc7)
+CVE-2026-99019 [scsi: ch: Do not keep references to data transfer element devices]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/27c0f718d3b3c99e6d315308e95d987d0382a8a8 (7.3-rc7)
+CVE-2026-99015 [Bluetooth: hci_sock: Serialize dead-device detachment]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/381a0925c556a8d91a80a9b9e3e86651d60ffee3 (7.3-rc7)
+CVE-2026-99014 [Bluetooth: hci_sync: Fix command skb lifetime during scan setup]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9af12272061d206af8bc3e40215cb694421ab73a (7.3-rc7)
+CVE-2026-99012 [Bluetooth: ISO: Serialize concurrent connect calls]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/e32d80293a0e1a160d5e5101daa8c82148c07510 (7.3-rc7)
+CVE-2026-99010 [Bluetooth: RFCOMM: free the skb when the DLC has no owner]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/9d1afbf60ed53c5b051cd124153e0ae3078c8b93 (7.3-rc7)
+CVE-2026-99009 [Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/ac022970e9fb0a5f7e7d1f6c8e104c1ed924dd1c (7.3-rc7)
+CVE-2026-99008 [Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/08e90633377f1b2567ab5ad6810b74c552246a07 (7.3-rc7)
+CVE-2026-99007 [drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/755c94d178b7e972bb766199d34e4ba4f63a89eb (7.3-rc7)
+CVE-2026-99006 [drm/i915/gem: Prevent overstepping exec array boundary]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/ebe162db655881a38de43301151ff7ac940602b5 (7.3-rc7)
+CVE-2026-99005 [drm/i915/gt: Unmask interrupts only when ACTIVE is true]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/5346b1cec6afa4f9b4b49a9f84e3cfef95a3f7bb (7.3-rc7)
+CVE-2026-99002 [drm/vmwgfx: validate pitch coming from userspace]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/21bc51cb89ced74d6645a138cc2f21184bc75094 (7.3-rc7)
+CVE-2026-98999 [drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/cf238c067eaae1cbfb00738e29219b9568d2313e (7.3-rc7)
+CVE-2026-98996 [fs: don't silently unmount busy mounts]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/6857e209015f95be7a8f19a9cd5dac345b9b9859 (7.3-rc7)
+CVE-2026-98993 [namespace: don't inherit MNT_UMOUNT in clone_mnt()]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/e2c6d326216642011da318b9edfd5d57ebd5a56f (7.3-rc7)
+CVE-2026-98992 [namespace: don't copy an unmounted mount tree]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/8bacbf6be959973b28b691713a872c12eae69eec (7.3-rc7)
+CVE-2026-98990 [namespace: check a submount for references right before unmounting it]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/32bf92416614a1e3ff3524fc6b780259c7aad3ef (7.3-rc7)
+CVE-2026-98989 [namespace: check a recursive bind mount for mount namespace loops]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/c640a01a78e42302879006ed7b7d5a9a943ba815 (7.3-rc7)
+CVE-2026-98985 [namespace: check the mounts before reading their parents in pivot_root()]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/6b7c001eb5857fa09041f47673666060a2e5fc1c (7.3-rc7)
+CVE-2026-98984 [dcache: don't put a mountpoint on a dentry that's being removed]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/75f4197f1e11d2eb75c2d6f916a7d4764db621e5 (7.3-rc7)
+CVE-2026-98983 [unshare: don't drop active namespace references that were never taken]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/0b6f31a3c0b16066f812e94b52a704174a6f23cd (7.3-rc7)
+CVE-2026-98981 [namespace: unhash a dentry before detaching the mounts on it]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/528b383dc35d1e5caf64ddf5d35f983ae543b0d0 (7.3-rc7)
+CVE-2026-98980 [namei: don't reveal overmounted entries in refwalk]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/8189ab688f5a2c745dc90b63374da02f213d6994 (7.3-rc7)
+CVE-2026-98979 [namespace: refuse an automount below a mount that is in no namespace]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/ba985ce08471c555af2a2fbe217c1bc2e72a6d8c (7.3-rc7)
+CVE-2026-98978 [namespace: never expire a locked mount]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/f78ddcc872248c7aa1d7e904928441a0be4c6d5d (7.3-rc7)
+CVE-2026-98977 [namespace: handle mount locking for automounts correctly]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/33aadc7c72055fca93cb5a3691d836ebf8b31c9b (7.3-rc7)
+CVE-2026-98975 [xfs: stop exchanging reflink flags when exchanging mappings]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/d84d6c1a7f1e2de9e601703a326a4c1b7b421943 (7.3-rc7)
+CVE-2026-98974 [xfs: fix exchange-range-to-eof file size exchange]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9 (7.3-rc7)
+CVE-2026-98972 [cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/e06b678e3b4e12fdaa0b51a7a5a54abc5dbd6469 (7.3-rc7)
+CVE-2026-98971 [gpio: exar: initialize the ID before registering its cleanup]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/4d69e74034b208588636ecc177e0dd43a7696af3 (7.3-rc7)
+CVE-2026-98970 [drm/vc4: Free the BO cache size list on teardown]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/b41ff8b529278216cba22a5dcdc93fea2a3a9619 (7.3-rc7)
+CVE-2026-98969 [net/sched: em_text: reject unterminated algo before autoload]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021 (7.3-rc7)
+CVE-2026-98968 [amt: send the relay's General Query directly from the receive path]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/afae89de73dd693cfa329580ba0fba63bd3f0a11 (7.3-rc7)
+CVE-2026-98967 [cxgb4/ch_ktls: disable softirqs around tid_list erases]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/4c9dc0faca98084922caeb689579d338cf3e1c29 (7.3-rc7)
+CVE-2026-98966 [bonding: fix the program leak when XDP is replaced]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/184b5ddf82d45d6f75cc83719a2e453392512bd2 (7.3-rc7)
+CVE-2026-98964 [nvmet: use the local P2P device on metadata allocation failure]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/4aa9c0f377a4de5e8fddce76b34ee4529639a1ff (7.3-rc7)
+CVE-2026-98960 [btrfs: don't stash io_uring encoded data across -EAGAIN]
+ - linux 7.2.11-1
+ [trixie] - linux <not-affected> (Vulnerable code not present)
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/51562a8cb11628d3a5e105b4c347ec5473e5745f (7.3-rc7)
+CVE-2026-98959 [btrfs: fix xattr replace when multiple xattrs are packed in the same item]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/858bee1c77857aabcc2327cd32dd8266332de332 (7.3-rc7)
+CVE-2026-98958 [wifi: mt76: account non-AQL frames per peer rather than per link]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/752770d7a58c821c17909c3ca67f9f14ab146a40 (7.3-rc7)
+CVE-2026-98957 [wifi: mt76: mt7915: disable rx napi when removing device]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/916c484d29d82f45c281da2786fcd6a1284430ce (7.3-rc7)
+CVE-2026-98956 [ASoC: adau1372: allow sleepy powerdown GPIOs]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/64dd172bbffe6135d79a06ddad53dd2da4d8bd62 (7.3-rc7)
+CVE-2026-98955 [flow_dissector: avoid u16 truncation of skb->len when computing thoff]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/99bda1ecbd56905f8bd934b9cdccd3bd251192b1 (7.3-rc7)
+CVE-2026-98954 [net: always dissect GSO packets in __virtio_net_hdr_to_skb()]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/44378d02c5aaae24b60a75fbbb539b4aa4db503d (7.3-rc7)
+CVE-2026-98951 [riscv: ptrace: Zero-initialize regset buffers before copyin]
+ - linux 7.2.11-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/59052a88ba5fe4a7bb34b3a0a42aa5d453d3bb97 (7.3-rc7)
+CVE-2026-98950 [flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/f202578efc738b883cfa04889eb97328914265a7 (7.3-rc7)
+CVE-2026-98947 [vsock: Fix memory leak in vmci_transport_recv_dgram_cb()]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/7c24a4e87e219072e5e106f6791146cbf3b056b3 (7.3-rc7)
+CVE-2026-98946 [drm/vc4: Disable the V3D interrupt across runtime suspend]
+ - linux 7.2.11-1
+ NOTE: https://git.kernel.org/linus/6abc8e4dcfbc1d26a94c0ac037dfb3716f686b1f (7.3-rc7)
+CVE-2026-98945 [HID: steam: Rearrange teardown sequence]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/ddce9641ce924ed91ec8304577e463823a29ffaf (7.3-rc1)
+CVE-2026-98944 [HID: steam: Refactor registration]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/6f9b740c31ba7e061b2ebb330d9a3d63f1358f29 (7.3-rc1)
+CVE-2026-98943 [HID: steam: Clean up locking]
+ - linux 7.2.11-1
+ [trixie] - linux 6.12.113-1
+ NOTE: https://git.kernel.org/linus/de1d341b9b3ec9655f31fb8b44f784cca5e670ad (7.3-rc1)
CVE-2026-98939 [x86/mm: Drop unnecessary PMD page copy when freeing]
- linux 7.2.10-1
[trixie] - linux <not-affected> (Vulnerable code not present)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89d49f4fbe4d1459938e177b373135c16d0bcb7c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89d49f4fbe4d1459938e177b373135c16d0bcb7c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/f23bf1c1/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list