[Git][security-tracker-team/security-tracker][master] Merge Linux CVEs from kernel-sec

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
549462de by Salvatore Bonaccorso at 2026-10-26T18:05:35+01:00
Merge Linux CVEs from kernel-sec

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,56 @@
+CVE-2026-99099 [x86/CPU/AMD: Fix AMD TLBI Erratum #1718]
+	- linux 7.2.11-1
+	[trixie] - linux <not-affected> (Vulnerable code not present)
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/87db7795cbaaf636ae22ae031f4906db7bb77803 (7.3-rc7)
+CVE-2026-99097 [tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/b7f925fd5226deb953c8dcdc9677d3fcc2717c00 (7.3-rc7)
+CVE-2026-99096 [io_uring/register: don't exempt disabled rings from task restrictions]
+	- linux 7.2.11-1
+	[trixie] - linux <not-affected> (Vulnerable code not present)
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/6da8f402e362b2f546e2efb7167fc9597aef6faf (7.3-rc7)
+CVE-2026-99094 [Bluetooth: btintel_pcie: fix TX descriptor bounds check]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/baa53af641c9e3644e717b8dfd1b95a55a0c111b (7.3-rc7)
+CVE-2026-99093 [mm: don't schedule deferred kernel page table freeing while booting]
+	- linux 7.2.11-1
+	[trixie] - linux <not-affected> (Vulnerable code not present)
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/2fb552b0bee70c24c092720028ab4620f5eb2646 (7.3-rc7)
+CVE-2026-99098 [dm-integrity: fix buffer overflow in inline mode with large tag size]
+	- linux 7.2.11-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/764b683a6180fd72c931c13fea98d383506a3475 (7.3-rc7)
+CVE-2026-99095 [drm/vc4: drain the hangcheck timer and works on V3D unbind]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	NOTE: https://git.kernel.org/linus/94cf5971b1d04c6382437387c4dc3836cc7a1437 (7.3-rc7)
+CVE-2026-99092 [riscv: patch: fix handling of bpf-jit execmem addresses]
+	- linux 7.2.11-1
+	[bookworm] - linux <not-affected> (Vulnerable code not present)
+	NOTE: https://git.kernel.org/linus/a510e1ae8c9030750c2edf7b0bc9b186cd8c7a06 (7.3-rc7)
+CVE-2026-99091 [Bluetooth: MGMT: Fix status of pending commands flushed on power off]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	NOTE: https://git.kernel.org/linus/86ef0f58bdecdedb3a1240971c56d71b7e4ce3fc (7.3-rc7)
+CVE-2026-99090 [drm/amdgpu: serialize vblank counter reads against GPU reset]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	NOTE: https://git.kernel.org/linus/1a6023edfbb5673f55fab6348f135fb3b1428ea5 (7.3-rc7)
+CVE-2026-99089 [ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	NOTE: https://git.kernel.org/linus/7529254014764ae0b8c33d5c61a58f36c65b1a1c (7.3-rc7)
+CVE-2026-99088 [net: openvswitch: validate transport header presence in set_ipv6_addr]
+	- linux 7.2.11-1
+	[trixie] - linux 6.12.113-1
+	NOTE: https://git.kernel.org/linus/3c6a4b11330fe424557538a98fca9f0a4c5bf313 (7.3-rc7)
 CVE-2026-107891
 	- musl <unfixed>
 	NOTE: https://www.openwall.com/lists/musl/2026/10/21/1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/549462de56f661d784da4e0605632debab4f3989

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/549462de56f661d784da4e0605632debab4f3989
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/02133d53/attachment.htm>