SB20260721156 - Debian update for linux
Published: July 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Improper locking (CVE-ID: CVE-2025-21807)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the queue_attr_store() function in block/blk-sysfs.c. A local user can perform a denial of service (DoS) attack.
2) Race condition (CVE-ID: CVE-2026-46093)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in decay_va_pool_node() when the shrinker path runs concurrently with vmap area purging. A local user can trigger concurrent shrinker and purge activity to cause a denial of service.
The issue can also result in possible memory leaks.
3) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-53027)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of attribute segment run loading in attr_data_get_block_locked() when processing compressed or sparse attributes with frame-aligned clusters. A local user can trigger the affected code path to cause a denial of service.
The issue is triggered when vcn is rounded down to the frame start and vcn and vcn0 reside in different attribute segments.
4) Use-after-free (CVE-ID: CVE-2026-53226)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the rockchip gpio irq domain handling in drivers/gpio/gpio-rockchip.c when removing a gpio bank and later processing generic irq chip suspend, resume, or shutdown callbacks. A local user can trigger device removal so that stale generic irq chip entries are later dereferenced to cause a denial of service.
The issue is associated with leaked domain generic chip structures that remain on the global gc_list after the gpio bank has been removed.
5) Improper input validation (CVE-ID: CVE-2026-53392)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ff_layout_alloc_lseg() in the NFSv4 flexfiles layout handling when processing a malformed flexfiles layout body with a zero filehandle-version array count. A remote attacker can send a specially crafted flexfiles layout to cause a denial of service.
The issue can lead to a null pointer dereference and kernel panic.
6) Use-after-free (CVE-ID: CVE-2026-53399)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in the nfsd layout stateid handling in fs/nfsd/nfs4layouts.c when processing layout stateid allocation failures after a setlease error. A remote user can trigger a setlease failure and subsequent IDR walker access to dereference a dangling pointer to cause a denial of service.
The issue occurs because a published stateid remains referenced in the IDR after the associated memory is freed, and a related destructor path may access uninitialized delayed work on the same failure path.
7) Out-of-bounds read (CVE-ID: CVE-2026-53402)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in fbcon_do_set_font() and subsequent rendering in the fbcon console subsystem when handling a failed font change rollback and later rendering user-controlled character indices. A local user can trigger a font change failure and then supply character indices greater than 255 to disclose sensitive information.
Exploitation requires a failure in the font-setting error path that leaves the console state desynchronized after vc_resize() fails.
8) Out-of-bounds read (CVE-ID: CVE-2026-63815)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in f2fs_fill_dentries() and inline directory handling when mounting a crafted filesystem image and reading an inline directory. A local user can mount a specially crafted image and read a crafted directory to disclose sensitive information.
Exploitation requires the flexible_inline_xattr feature to be enabled.
9) Use-after-free (CVE-ID: CVE-2026-63816)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the f2fs garbage collection code when handling F2FS_IOC_GARBAGE_COLLECT_RANGE on a copy-on-write file. A local user can trigger garbage collection while the associated atomic inode is being evicted to cause a denial of service.
The issue involves access to atomic_inode->i_mapping without holding a reference to the atomic inode.
10) Out-of-bounds read (CVE-ID: CVE-2026-63818)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in f2fs_recover_orphan_inodes() when mounting a crafted f2fs image and replaying orphan inodes from the checkpoint pack. A local user can provide a crafted filesystem image with a corrupted orphan block entry count to cause a denial of service.
The issue occurs when the orphan block entry count is larger than F2FS_ORPHANS_PER_BLOCK, causing the recovery code to read past the ino[] array and interpret subsequent data as inode numbers.
11) NULL pointer dereference (CVE-ID: CVE-2026-64187)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in xlog_recover_reorder_trans in the XFS log recovery code when processing a crafted log during filesystem recovery. A local user can provide a crafted log item with no regions to trigger a kernel fault and cause a denial of service.
This issue only occurs for crafted log data during recovery, as the normal runtime commit path does not generate such a transaction.
12) Use-after-free (CVE-ID: CVE-2026-64189)
CWE-ID: CWE-416 - Use After Free
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in ip_set_dump_do() and ip_set_dump_done() in the ipset netfilter subsystem when handling netlink dump operations concurrently with ip_set_list resizing. A local user can trigger concurrent netlink dump and set creation operations to cause a denial of service.
The issue can lead to a general protection fault and kernel panic.
Remediation
Install update from vendor's website.