SB20260831116 - Debian update for linux
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2025-40074)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the ipv4_neigh_lookup() function in net/ipv4/route.c. A local user can escalate privileges on the system.
2) Use-after-free (CVE-ID: CVE-2026-64216)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in netfs_unlock_abandoned_read_pages() and netfs_unlock_read_folio() when handling abandoned read pages and read folios. A local user can trigger the vulnerable code path to cause a denial of service.
The issue occurs because ownership of the folio specified by no_unlock_folio reverts to the caller after NETFS_RREQ_IN_PROGRESS is cleared, making dereference of that folio unsafe in this context.
3) Double free (CVE-ID: CVE-2026-64581)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in xfrm_user_policy() when racing a per-socket policy change with packet transmission on a connected UDP socket. A local user can trigger concurrent socket operations to cause a denial of service.
The issue is reachable by an unprivileged user via a user and network namespace.
4) Improper resource shutdown or release (CVE-ID: CVE-2026-74626)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in ntb_netdev_rx_handler() in the ntb_netdev driver when handling received packets and allocating replacement receive buffers. A remote attacker can send packets that trigger allocation failures and exhaust the receive queue to cause a denial of service.
The issue can stall packet reception while the network interface remains up.
5) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74653)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a stuck RX timeout condition in 8250_of for the LPC32xx UART when handling serial port interrupts. A local user can repeatedly open the front-panel serial port to cause a denial of service.
The issue can trigger a persistent interrupt storm that livelocks the CPU and trips the soft-lockup detector on affected single-core systems.
6) Race condition (CVE-ID: CVE-2026-74662)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a race condition in inet_frag_create() and the fragment queue timer handling in net/ipv4/inet_fragment.c when processing fragmented packets with a zero or negative fragment timeout. A remote attacker can send specially crafted fragmented network traffic to cause a denial of service.
The issue occurs because the timer may run before the queue is published in the fqdir rhashtable, which can leave a stale hash node after reference handling becomes unbalanced.
7) Out-of-bounds write (CVE-ID: CVE-2026-80536)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in xlog_recover_do_reg_buffer() when processing a crafted XFS filesystem image during mount-time log recovery. A remote attacker can mount a specially crafted filesystem image to execute arbitrary code.
The issue is reachable during mount-time recovery on production kernels where the bounds check was enforced only by an ASSERT().
8) Out-of-bounds read (CVE-ID: CVE-2026-80557)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, execute arbitrary code, or cause a denial of service.
The vulnerability exists due to an out-of-bounds read in decode_watchers() when processing a crafted obj_list_watch_response_t reply with struct_len set to 0. A remote attacker can send a specially crafted OSD response to disclose sensitive information, execute arbitrary code, or cause a denial of service.
Exploitation requires a malicious or compromised OSD and can be triggered when a kernel client invokes CEPH_OSD_OP_LIST_WATCHERS.
9) Improper locking (CVE-ID: CVE-2026-80562)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock type selection in the gpio-ml-ioh driver irq callbacks when invoking irq_set_type, irq_enable, or irq_disable while the IRQ descriptor lock is held in a non-sleepable context. A local user can trigger these callbacks to cause a denial of service.
The issue is specific to PREEMPT_RT kernels.
10) Use-after-free (CVE-ID: CVE-2026-80572)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to a use-after-free in the byd driver timer callback handling in drivers/input/mouse/byd.c when disconnecting the device while timer callbacks are running or being re-armed. A local user can trigger a race condition to execute arbitrary code.
The issue arises because the callback can dereference freed private data and its psmouse pointer during driver disconnect.
11) Out-of-bounds write (CVE-ID: CVE-2026-80583)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify memory, or cause a denial of service.
The vulnerability exists due to an out-of-bounds write in the tx_macro_dec_mode_get() and tx_macro_dec_mode_put() kcontrol handlers in sound/soc/codecs/lpass-tx-macro.c when accessing enumerated control values. A local user can access a crafted enumerated control value through the "DEC0 MODE" to "DEC7 MODE" controls to disclose sensitive information, modify memory, or cause a denial of service.
On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the issue is detected as an access overflow and reads of these controls fail with -EINVAL.
12) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-80590)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of gso metadata in inet fragment reassembly when processing crafted IP fragments with attached GSO state. A local user can write specially crafted packets to a tap device to cause a denial of service.
The issue can be triggered by an unprivileged user in its own user namespace, and it may also be reachable in environments where virtio_net_hdr metadata is forwarded to a tap device or where CAP_NET_RAW is available in a network namespace.
13) Out-of-bounds write (CVE-ID: CVE-2026-80725)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in skb_gro_receive() and IPv6 GRO completion handling when processing crafted packets for BIG TCP aggregation beyond 64KB. A local user can inject specially crafted frames to cause memory corruption.
Exploitation requires access to inject crafted frames through AF_PACKET, and the issue is limited to older stable branches rather than mainline 7.0 and later.
Remediation
Install update from vendor's website.