CLSA-2026:1784731021 TuxCare License Agreement 0 * Move gpg key and repo installation from debian/install to postinst * Add support for multiple deb platforms None Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Move gpg key and repo installation from debian/install to postinst * Add support for multiple deb platforms

0 tuxcare-debian11-els els-os-release_1.0.0-2_amd64.deb 592ac15b82099f73fe416e2bb3c5a55f96ef34d4 CLSA-2026:1787744573 TuxCare License Agreement 0 * Add wget to Build-Depends None Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Add wget to Build-Depends

0 tuxcare-debian11-els els-os-release_1.0.0-4_amd64.deb 7e2d27821ab8bdf65d6416417dc6df54eb63b986 CLSA-2026:1788696775 TuxCare License Agreement 0 * SECURITY UPDATE: use-after-free in the DTD parser reachable through xmlParseInternalSubset() - debian/patches/CVE-2026-6653.patch: stop xmlPushInput() in parser.c from returning -1 when the parser has already been halted, since inputPush() has by then installed the input as ctxt->input and the caller reads -1 as "ownership not transferred" and frees it. xmlParsePEReference() then leaves ctxt->input dangling and xmlParseInternalSubset()'s loop reads through it in RAW, which is evaluated before the XML_PARSER_EOF test can short-circuit. The halt itself comes from the amplification check in xmlParserEntityCheck() added by Patch-for-security-issue-CVE-2021-3541.patch and is left untouched - CVE-2026-6653 * SECURITY UPDATE: stack buffer overflows in xmlcatalog --shell mode - debian/patches/CVE-2026-11979.patch: add capacity checks to the command, argument and argv loops of the usershell() command-line parser in xmlcatalog.c, so an over-long --shell command line is rejected instead of written past the end of the on-stack buffers - CVE-2026-11979 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: use-after-free in the DTD parser reachable through xmlParseInternalSubset() - debian/patches/CVE-2026-6653.patch: stop xmlPushInput() in parser.c from returning -1 when the parser has already been halted, since inputPush() has by then installed the input as ctxt->input and the caller reads -1 as "ownership not transferred" and frees it. xmlParsePEReference() then leaves ctxt->input dangling and xmlParseInternalSubset()'s loop reads through it in RAW, which is evaluated before the XML_PARSER_EOF test can short-circuit. The halt itself comes from the amplification check in xmlParserEntityCheck() added by Patch-for-security-issue-CVE-2021-3541.patch and is left untouched - CVE-2026-6653 * SECURITY UPDATE: stack buffer overflows in xmlcatalog --shell mode - debian/patches/CVE-2026-11979.patch: add capacity checks to the command, argument and argv loops of the usershell() command-line parser in xmlcatalog.c, so an over-long --shell command line is rejected instead of written past the end of the on-stack buffers - CVE-2026-11979

0 tuxcare-debian11-els libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_amd64.deb 0d7f5287cff6bfa8474c8ddb8d136c62f5c3a6eb libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_amd64.deb 30133d1406b3001cdcc5ac01826e6bf01a182c90 libxml2-doc_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_all.deb 357bd64457a69b166a7d0ffb649cecf2697f4e65 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_amd64.deb 168ed52a6a4408e18faf3d3ca29f0708c9b56dac python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_amd64.deb a29b2e1add065c63d9ff03dfeff01c37224d3f2b libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_arm64.deb 81cc7d93f00827f4ba144351291a53f2af6e2f67 libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_arm64.deb a157851f1d4740a5054f1ec17c3cc004aa7a22b8 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_arm64.deb 092b5137851befc5d0585533104618ac07343de6 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_arm64.deb 526fb40a9a24c736e6e1d6ff356dac8745393779 libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_armel.deb 5b0de4dcc99b1e97e2bd23b1762047931b23a71d libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_armel.deb 20febe8f85e966dc7eafc1f728e633b8575d2589 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_armel.deb d0147b4a5323b2c354093e641ff50c3cef1e15d5 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els1_armel.deb 173c9d0d65fce7dd26a5f5af7862fbbe52f9474c CLSA-2026:1788699858 TuxCare License Agreement 0 * SECURITY UPDATE: HTTP/2 denial of service via rapid stream reset (HTTP/2 Rapid Reset) - debian/patches/CVE-2023-44487.patch: limit new streams to 2 * http2_max_concurrent_streams per event loop iteration in ngx_http_v2_state_headers, and cap refused streams at the maximum of http2_max_concurrent_streams and 100, so a client that opens and immediately cancels streams can no longer pin worker CPU - CVE-2023-44487 * SECURITY UPDATE: buffer overrun in the script engine via map directives using regex matching with a string expression - debian/patches/CVE-2026-42533.patch: add an e->end bound and an ngx_http_script_check_length() guard to the script copy code paths in both the http and stream script engines, and thread a separate header/parameter length accumulator through the proxy (headers_len, body_len), grpc (headers_len), fastcgi, scgi and uwsgi (params_len) upstream request builders, the http and stream access log writers, and the index, try_files and rewrite modules, so an attacker-controlled map+regex expansion can no longer overrun the assembled request, log or result buffer. Also drops uninitialised trailing bytes from complex values, which previously leaked to the client. - CVE-2026-42533 * SECURITY UPDATE: use-after-free via duplicate subrequest finalization in ngx_http_ssi_filter_module - debian/patches/CVE-2026-56434.patch: skip posting a request that is already on r->main->posted_requests in ngx_http_post_request, and reset r->write_event_handler to the empty handler during active subrequest finalization, so a subrequest posted twice can no longer be finalized twice and over-decrement r->main->count - CVE-2026-56434 * SECURITY UPDATE: uninitialized memory read via stale regex captures - debian/patches/CVE-2026-60005.patch: reset r->ncaptures when ngx_http_regex_exec reallocates r->captures, so a subsequent unnamed capture reference after a non-matching regex no longer reads uninitialized memory - CVE-2026-60005 * The CVE-2026-42533 patch additionally carries two upstream commits that are not part of the vulnerability fix but are required for it not to regress this package: - e09c0d32d51c reserves NGX_OFF_T_LEN rather than NGX_SIZE_T_LEN for the access log "request_length" variable, whose handler formats with %O. Without it the new length guard rejects every log line containing $request_length on 32-bit architectures (armel here), where off_t is 8 bytes and size_t is 4. - 4b90ec769235 restores the stack push in ngx_http_script_complex_value_code and has the new end code update that slot instead. Without it any module reusing ngx_http_script_complex_value_code without emitting the new end code -- which includes the ngx_devel_kit copy in debian/modules/http-ndk, and hence libnginx-mod-http-ndk and libnginx-mod-http-lua -- pops a stack slot that was never pushed. * Note for out-of-tree dynamic modules: the CVE-2023-44487 patch inserts two fields into ngx_http_v2_connection_t and the CVE-2026-42533 patch inserts one into ngx_http_script_engine_t, which shifts the offsets of later members in both. nginx_version and NGX_MODULE_SIGNATURE do not encode struct layout, so such a module loads without complaint. Every libnginx-mod-* package in this source package is rebuilt here and is unaffected; dynamic modules built elsewhere against 1.18.0-6.1+deb11u8 headers must be rebuilt. Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: HTTP/2 denial of service via rapid stream reset (HTTP/2 Rapid Reset) - debian/patches/CVE-2023-44487.patch: limit new streams to 2 * http2_max_concurrent_streams per event loop iteration in ngx_http_v2_state_headers, and cap refused streams at the maximum of http2_max_concurrent_streams and 100, so a client that opens and immediately cancels streams can no longer pin worker CPU - CVE-2023-44487 * SECURITY UPDATE: buffer overrun in the script engine via map directives using regex matching with a string expression - debian/patches/CVE-2026-42533.patch: add an e->end bound and an ngx_http_script_check_length() guard to the script copy code paths in both the http and stream script engines, and thread a separate header/parameter length accumulator through the proxy (headers_len, body_len), grpc (headers_len), fastcgi, scgi and uwsgi (params_len) upstream request builders, the http and stream access log writers, and the index, try_files and rewrite modules, so an attacker-controlled map+regex expansion can no longer overrun the assembled request, log or result buffer. Also drops uninitialised trailing bytes from complex values, which previously leaked to the client. - CVE-2026-42533 * SECURITY UPDATE: use-after-free via duplicate subrequest finalization in ngx_http_ssi_filter_module - debian/patches/CVE-2026-56434.patch: skip posting a request that is already on r->main->posted_requests in ngx_http_post_request, and reset r->write_event_handler to the empty handler during active subrequest finalization, so a subrequest posted twice can no longer be finalized twice and over-decrement r->main->count - CVE-2026-56434 * SECURITY UPDATE: uninitialized memory read via stale regex captures - debian/patches/CVE-2026-60005.patch: reset r->ncaptures when ngx_http_regex_exec reallocates r->captures, so a subsequent unnamed capture reference after a non-matching regex no longer reads uninitialized memory - CVE-2026-60005 * The CVE-2026-42533 patch additionally carries two upstream commits that are not part of the vulnerability fix but are required for it not to regress this package: - e09c0d32d51c reserves NGX_OFF_T_LEN rather than NGX_SIZE_T_LEN for the access log "request_length" variable, whose handler formats with %O. Without it the new length guard rejects every log line containing $request_length on 32-bit architectures (armel here), where off_t is 8 bytes and size_t is 4. - 4b90ec769235 restores the stack push in ngx_http_script_complex_value_code and has the new end code update that slot instead. Without it any module reusing ngx_http_script_complex_value_code without emitting the new end code -- which includes the ngx_devel_kit copy in debian/modules/http-ndk, and hence libnginx-mod-http-ndk and libnginx-mod-http-lua -- pops a stack slot that was never pushed. * Note for out-of-tree dynamic modules: the CVE-2023-44487 patch inserts two fields into ngx_http_v2_connection_t and the CVE-2026-42533 patch inserts one into ngx_http_script_engine_t, which shifts the offsets of later members in both. nginx_version and NGX_MODULE_SIGNATURE do not encode struct layout, so such a module loads without complaint. Every libnginx-mod-* package in this source package is rebuilt here and is unaffected; dynamic modules built elsewhere against 1.18.0-6.1+deb11u8 headers must be rebuilt.

0 tuxcare-debian11-els libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb be3bba0282d1355333f225b330006037993374ab libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb ce9d9de3d701ee7c37afdafefc65fe1a831e744b libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb cca338a6c271917e8dc370dbc2741d200c9fa072 libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 03b2b52f5d0c0effe9a4e8af929f7132d05a4b65 libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 356ca02bfbf3c262022b8bb067fb9ab554da6205 libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb dde0811ac3f7a5dcb3b35f4389557aa143408f4e libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 9fbd911fe018f7ee3c0ef5334ae9aa5f03f19226 libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb e251192310c18364e893ab98601479bd88680fa8 libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 8ce43e3f1333278d7bcc15613bd334b780b0381d libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 83b7c9086bc6234ea7aa1116d44b8f12fd14ee7a libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 3da17aacd49a0ae3fefa3f330b7cf6e59f93b472 libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 2a00a33da1055bd14d3f8a40eff9c1f6562f0bda libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb af4146078e8145c1eb154a73208a08d89bae5b64 libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 14c604efc2a505efe6677111fdf5624a621a01ec libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb a6722163834937db2b0020ba7c433f4b2468800c libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 5b61b3276e696a968ee255fe515f333aa68905f2 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 12dbb25881cea4fb1994d15d0f958adcbb9d182f libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb dad0e0ffe998484ce198971fd8b22b4fda39109e libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 8f98d3890b517401b07e95e4ac9a3ba6ec95d9ba libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb f364fc673580dbf05b7667b7aa83f95ba41b17b0 libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 69103dd1f4520e86d713c2a7147ee97ab3909583 libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb fc855b9a4608f06770a2d2a16ca96c7974a2103d nginx_1.18.0-6.1+deb11u8+tuxcare.els1_all.deb ab6cf4bca4569f595ad06c166e5b0f7ea53e2a44 nginx-common_1.18.0-6.1+deb11u8+tuxcare.els1_all.deb 7e8058dacf4c00f330b15e2da5166b04613591e5 nginx-core_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb 790b36502236beebae0dfc5f4c55f186b1e7d355 nginx-doc_1.18.0-6.1+deb11u8+tuxcare.els1_all.deb 508f82548943a92d6755cfee4d63206899b06342 nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb f3636ba0540a9a9950b7e94b9cfa8032f77bb392 nginx-full_1.18.0-6.1+deb11u8+tuxcare.els1_all.deb 4f6f294a18c1019b0a8b2865462a692bceae3b94 nginx-light_1.18.0-6.1+deb11u8+tuxcare.els1_amd64.deb a405d91785a5ab553bc911ef6acade6792009c4f libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 28b89874570af904ea17ee68fa9d3f40be0db617 libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb ec830ea948b7b1597dd8c788b94861704c950fb3 libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb f159d388a6adca93da1d1985f473967fa7ed9eed libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb ad2602e30e45e8609dd7c8262cf73d5340568660 libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 8c54d32e069936d52360746054332f211ab751ca libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 68ecd7519c02f088825dff37e24c001e1e720cd5 libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb a4e60c093f31b8d89cc26c2a9a39d57ea5edb617 libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb d422f267ad5ae83f0a9439571a1e2995f7d9e14b libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 07eaa30a5b72fcea2b07225717a1538c80d11c42 libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb ea9710547f4db859b3705af6f83b685a68241f9c libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 6749d465f77df762e81975b0d02be1df5371d3c7 libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb c8835d30829d302a0a00d76f1bb737d99d54b2ed libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb bb18941f9f6cba41a5bb20f44f161e3a3a013245 libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb e8a42613d09fe7c4463a59a7cee3afffcbcca855 libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 43a9394153b86a1e5e42efb266486b40f42a1880 libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 70887395f1616559de96c17228d0ba59ee527ac8 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 4a5cedad955e3d6b60367b825bca5f942dd10836 libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 52f6ad73d886406bc6b8f877970dcf4dbc901517 libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb c2012f711f4f447a6b4d49fc45b5c9edf0c7a24d libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 3bb6720a1e552e57f9dae7e1ad879486c6bdfae1 libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 734c0357f4c8dabde22de931c7609c66aa736c1d libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 814b3f1f6b54e2aa5b4414ef962d4eb64d612a2b nginx-core_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 8178da0e0e0405c9f40132c15c6bb75642e04b92 nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 73da9ee0d1b9270ee44f923fc1692d0575ce8ccb nginx-light_1.18.0-6.1+deb11u8+tuxcare.els1_arm64.deb 7b18e6dd97a2dc641b266fb860e350c296a5e217 libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 55a6c7053074054d4da241ab615b25cc310a07ed libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb dcc6a5a20d167bffb35fc0600f9dba2bb6471c77 libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb e1068bb64c90122f8de7a5dd50bd7dbd792bbb88 libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 5f04bb63a54948a49db3287e1b037feb1525eb01 libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb dedbda065558ffb11849886f7871d447d73607cf libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 5131e9831ce14ad4e7a8b255f590ded284d32332 libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 4e7cbdeb07ffec82215815512228ad99e9aee24a libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb deebc05a0de36cc84db376c929423464d5472f3d libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 793746daa7a5670be520d38c5e62671ded971b7a libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb d4b925a8dc6c063212392f489f4a3f630118ba7c libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 40b4d61d7c27a53523ab98e00f7870d0ae0e0e74 libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb d5258b1bd278b7813cf34be31f05c9ecf02957ba libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 7df34a86b55e92c9a79a7cffe3ab20378b65c6e4 libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb bbb563669161a130021cc0251af982b77981c6bb libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 051dc904d50f493727d77b44ed19cc47da10fe53 libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 4408a3dbc58d81cb1f49e96a141cffa04d3d7ce5 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 6728903329cfed9a4c7ad99fedae1ab3ff1afee1 libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 815696db019aadf1daa99b3141ec14d2bf7d8b02 libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb cfd9b8b63b0546b8d6430e04dc4282cc199930aa libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 2ee92277c34e4abf3e327830f9662b8ab6cabada libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb d7ade2fad58995e9a46540e41f8e80025f3b7330 libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 4d09c085a98529683f02c30415eb8a41922df630 nginx-core_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 52bdd39ad0dd94485bb166e98e2ff45c7e0b68df nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb 5bd4fadb042ca75567b91d16aad48e91a62d16b8 nginx-light_1.18.0-6.1+deb11u8+tuxcare.els1_armel.deb a33107450916b2378e1401d2298bc8026e3fdde4 CLSA-2026:1788773292 TuxCare License Agreement 0 * SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion - debian/patches/CVE-2026-55204.patch: add missing NULL check after hpack_dht_defrag() in hpack_dht_insert() in src/hpack-tbl.c - CVE-2026-55204 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: NULL pointer dereference in HPACK dynamic table insertion - debian/patches/CVE-2026-55204.patch: add missing NULL check after hpack_dht_defrag() in hpack_dht_insert() in src/hpack-tbl.c - CVE-2026-55204

0 tuxcare-debian11-els haproxy_2.2.9-2+deb11u7+tuxcare.els1_amd64.deb 925d4bf9d6c804d1d08c47dcd57859942dfd1e91 haproxy-doc_2.2.9-2+deb11u7+tuxcare.els1_all.deb 2256812e985b3721df4088e1f3d42cb983f7e66d vim-haproxy_2.2.9-2+deb11u7+tuxcare.els1_all.deb 3d7c90496cfa9b3b38602915f844beb02751bed8 haproxy_2.2.9-2+deb11u7+tuxcare.els1_arm64.deb f34113a8528f8e43c06cf4ba4d7c5844290dd4e2 haproxy_2.2.9-2+deb11u7+tuxcare.els1_armel.deb c66de6c46caaff723f51a6211b65aff4a53cd817 CLSA-2026:1788774752 TuxCare License Agreement 0 * SECURITY UPDATE: Fix allocated buffer overflow in gmon __monstartup - debian/patches/CVE-2023-0687.patch: round up the froms hash table size to the froms element alignment in gmon/gmon.c - CVE-2023-0687 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Fix allocated buffer overflow in gmon __monstartup - debian/patches/CVE-2023-0687.patch: round up the froms hash table size to the froms element alignment in gmon/gmon.c - CVE-2023-0687

0 tuxcare-debian11-els glibc-doc_2.31-13+deb11u14+tuxcare.els1_all.deb 235cc7c2798b86d09cff884fe1fcda485e858223 glibc-source_2.31-13+deb11u14+tuxcare.els1_all.deb ef1ef8755c1fe45cfae1fcf568b1c30c45d7af7f libc-bin_2.31-13+deb11u14+tuxcare.els1_amd64.deb 319512fda77f41300b194c830e2ccdf222cc4d81 libc-dev-bin_2.31-13+deb11u14+tuxcare.els1_amd64.deb 07b2c6413cb81d6ec16364af355af5bb92766c33 libc-devtools_2.31-13+deb11u14+tuxcare.els1_amd64.deb 27719cf465f2ffa0f1a733f15979b0b17b0f1c21 libc-l10n_2.31-13+deb11u14+tuxcare.els1_all.deb f27527a607d7b1d07279027ced3a62b54f9a8c78 libc6_2.31-13+deb11u14+tuxcare.els1_amd64.deb b2697480d5293eb34702f7160b6d19ea3f6c6494 libc6-dev_2.31-13+deb11u14+tuxcare.els1_amd64.deb 7557403a4bff7f27dc704424880478c32ac78c7e libc6-dev-i386_2.31-13+deb11u14+tuxcare.els1_amd64.deb 0ea36049733c0cc646e46742a29ef861ca09db05 libc6-dev-x32_2.31-13+deb11u14+tuxcare.els1_amd64.deb 080d87ae7b78cec13a9f70a6fde6da8b1fb06bf1 libc6-i386_2.31-13+deb11u14+tuxcare.els1_amd64.deb 2d28144536616600cef83ea005981a34eb87adbb libc6-x32_2.31-13+deb11u14+tuxcare.els1_amd64.deb 0012d9f67b191248dcbf79d3ffbdb867ddcdbfb6 locales_2.31-13+deb11u14+tuxcare.els1_all.deb 36c4601f4ff4c29d6f4260612dc673a26d996726 locales-all_2.31-13+deb11u14+tuxcare.els1_amd64.deb 0f55009c16585f685c873bce82fc866c8fde6a8e nscd_2.31-13+deb11u14+tuxcare.els1_amd64.deb 29ae50bfd651357f905dcc64030e99004044738a libc-bin_2.31-13+deb11u14+tuxcare.els1_arm64.deb 6ba64a64b533289e37d437b5a9cb66d60efa0820 libc-dev-bin_2.31-13+deb11u14+tuxcare.els1_arm64.deb 5b0d8a61cacd19d1be8bc7aff072f30267752d3c libc-devtools_2.31-13+deb11u14+tuxcare.els1_arm64.deb 3efc7930016caaad901786c4b1348003ea8fa895 libc6_2.31-13+deb11u14+tuxcare.els1_arm64.deb b5be6006b91fe010777a3dd938c3cb836396c599 libc6-dev_2.31-13+deb11u14+tuxcare.els1_arm64.deb 3ebc108845febdb78b495abc06cf4d2b0aca5b88 locales-all_2.31-13+deb11u14+tuxcare.els1_arm64.deb 8741ce7a779ee4667d8ffd604e5d322fd01a301b nscd_2.31-13+deb11u14+tuxcare.els1_arm64.deb cd43ad7b9b6d2554e2f519330f8432c4eeadc136 libc-bin_2.31-13+deb11u14+tuxcare.els1_armel.deb 4359013b67fd072f91d411250899fecd237adec1 libc-dev-bin_2.31-13+deb11u14+tuxcare.els1_armel.deb bea45cb61d411f5b5b4225ade270c551080449c7 libc-devtools_2.31-13+deb11u14+tuxcare.els1_armel.deb d09a9738935523b6a475aab5dfa2bea7a72eea98 libc6_2.31-13+deb11u14+tuxcare.els1_armel.deb 07503b381cb4c1b8fffec8de02b2558bd926b11b libc6-dev_2.31-13+deb11u14+tuxcare.els1_armel.deb a50b3de61a35c226a8a8720df6b9dc789c49a12e locales-all_2.31-13+deb11u14+tuxcare.els1_armel.deb 9fa94c4f1910ae899418393815736688c94961e9 nscd_2.31-13+deb11u14+tuxcare.els1_armel.deb 8eb44c79ab8d8d09d293eac3bdcf4f55d83e0b6f CLSA-2026:1788774936 TuxCare License Agreement 0 * SECURITY UPDATE: Memory leak via repeated tls-crypt key setup - debian/patches/CVE-2026-13698.patch: ensure tls-crypt keys are not set up twice by directly inferring whether the key context is already initialised - CVE-2026-13698 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Memory leak via repeated tls-crypt key setup - debian/patches/CVE-2026-13698.patch: ensure tls-crypt keys are not set up twice by directly inferring whether the key context is already initialised - CVE-2026-13698

0 tuxcare-debian11-els openvpn_2.5.1-3+deb11u4+tuxcare.els1_amd64.deb fffdc6eef680a5dbcf6c7d64bb82d625351e255a openvpn_2.5.1-3+deb11u4+tuxcare.els1_arm64.deb 745fbd2f4c5311131af79f9ccb2738c8fc7c30d2 openvpn_2.5.1-3+deb11u4+tuxcare.els1_armel.deb d8eb8c0190c64c065008e3f6b1b03ced1cb7dd37 CLSA-2026:1788786309 TuxCare License Agreement 0 * SECURITY UPDATE: Fix integer truncation in the kdb5_util dump loader - debian/patches/CVE-2018-5709.patch: add bounds checks in process_k5beta7_princ() so oversized dump file fields cannot be truncated when assigned to smaller structure fields - CVE-2018-5709 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Fix integer truncation in the kdb5_util dump loader - debian/patches/CVE-2018-5709.patch: add bounds checks in process_k5beta7_princ() so oversized dump file fields cannot be truncated when assigned to smaller structure fields - CVE-2018-5709

0 tuxcare-debian11-els krb5-admin-server_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 7811b35d0fe02e65a85c95845f2c070238a80173 krb5-doc_1.18.3-6+deb11u8+tuxcare.els1_all.deb a9fec200ddd4b713a6cf61419c510b373b2971e5 krb5-gss-samples_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb c7e334d580d6fdb00a3c3f26e9598e974ce6ac64 krb5-k5tls_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 4d1ecfab0b3217e7465d4ab6c76124504f3e32cf krb5-kdc_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 16fff302192b1e867d83c51d9651b9e482756d05 krb5-kdc-ldap_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 3e87a871690d414dadd4ae7c7723cea463e625f3 krb5-kpropd_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 17b0824f437a8b09bcd6e67184650f91c2b6e07d krb5-locales_1.18.3-6+deb11u8+tuxcare.els1_all.deb 7f962e164fed55cc057b639b69e439dd16fceb1f krb5-multidev_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb f504091426d9a0b088945e2169edc5706182c2f7 krb5-otp_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 7835ba2b096a95842a114489573bc6f40b5f7323 krb5-pkinit_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 5988bb6e1b2f5bc982a0d77237d19c3d8008b55d krb5-user_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 22f8fe5b45a7addd229888f7f1dc51dbfaa1b273 libgssapi-krb5-2_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb c6f959994c7d141a8fd740f24cb787a685ef0c7a libgssrpc4_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 9da8e5d749355bb188c5b4e5043301d7e3cbd810 libk5crypto3_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 13f7f89c1c69ca93a1b437a12c958f02832861e3 libkadm5clnt-mit12_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb bc6977c3a48b2753dd1b17dd435fd3231b2bb917 libkadm5srv-mit12_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb d1c5850b236b682fa65d542dd4632c9034b0c3e4 libkdb5-10_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 3525bb09dec6b38049daf74c7ef9aa7962d2fcee libkrad-dev_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 20ec4239ecdea01c3b8b40f24925a7c01d4859ba libkrad0_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb c134af8aa9b778a72ee9124c4f5610df1186ca57 libkrb5-3_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 49ae81e128c2c3708f43198da9b699186386389e libkrb5-dev_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 8ce80ce411387ad8a0d34e9927afeefffbf5679f libkrb5support0_1.18.3-6+deb11u8+tuxcare.els1_amd64.deb 6b4a08da2c3f769658a9262ca59a4d410f9333fb krb5-admin-server_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 8195e38cd77dc8030c7a123b7797b5a6a5c6da2d krb5-gss-samples_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb a19e54f9140aa705b3003e3cbabb67e9adcd8208 krb5-k5tls_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 79328737d5edaaa8e5f9665455838cfd3eafd62e krb5-kdc_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 1752d697ea83350e55289f9d87b79301206aedc0 krb5-kdc-ldap_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 486b27bcdb349fea2211f00643747d22cb177c9a krb5-kpropd_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 8896a923fb8bbba39ba0cf0559b82d59dab32d82 krb5-multidev_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 754ab69afd14d3d8c492b050454343a8d0a87717 krb5-otp_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 182c59d45fbbed0e4972bba560f811b7fd5c604b krb5-pkinit_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 67158ae3d50ab5fc12e13b8eec3097ad743949e3 krb5-user_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb dcd434d65111bd4331856428d76dd9fdf308e0b7 libgssapi-krb5-2_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 097877196d0c03a07fcc46f1552bf8041c7cfe6f libgssrpc4_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 9854b2f7d9e5765d636fd4a2bfea8ae1ab63d6a3 libk5crypto3_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb d056570961548715c811d26e61561f624cff2308 libkadm5clnt-mit12_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb d8dfa4850fb308f0c9cd96261f3017d3c8e2c35c libkadm5srv-mit12_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 73f64adc7b4a90873036d88a9c931930e6da3869 libkdb5-10_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb a64c426f09fd10bc348e49dbc1d295f0f938fbf3 libkrad-dev_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 1e06c741bc91b9b3b1e31bf7515f9921ad51991c libkrad0_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb d130abb2d05259f3bc31c70c0bbdf40070916bbe libkrb5-3_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 24f6cf294d79aa4ff0b41b3c136933318093b43b libkrb5-dev_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 4b3ff3669e35053f406e131257e328cb9aaf08e8 libkrb5support0_1.18.3-6+deb11u8+tuxcare.els1_arm64.deb 868908f0ba28b46b91e3ec6dcaa7228ef4159117 krb5-admin-server_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 4e52ba63236101dd515b3b72a54f00462b2a0ef7 krb5-gss-samples_1.18.3-6+deb11u8+tuxcare.els1_armel.deb e78336a8ca8a49ca22e621ffe1aaf03abf9b1404 krb5-k5tls_1.18.3-6+deb11u8+tuxcare.els1_armel.deb a91617cc0621ce4a1137886356647afcaf6bbd40 krb5-kdc_1.18.3-6+deb11u8+tuxcare.els1_armel.deb be152bab2e24545820cb32d607090bf25a09c4ae krb5-kdc-ldap_1.18.3-6+deb11u8+tuxcare.els1_armel.deb a381b65500497b74422ad7e6241301c53466c710 krb5-kpropd_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 324ed8854089833588d4c304765fd09b8df3971a krb5-multidev_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 17d39059efc269283dda08d7bb29c1309e0af3fd krb5-otp_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 7c9765fba8d8bcc1f6cd79a827e657c07b09dccd krb5-pkinit_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 547311cd0a9a144ea9cf8a2805d5b25c49dd4958 krb5-user_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 428e20faded98950b6128b8b19f2985a2ea169b2 libgssapi-krb5-2_1.18.3-6+deb11u8+tuxcare.els1_armel.deb da3b3af0f13c0d62d96d1f7289cd63272bef5498 libgssrpc4_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 4f83d36101bd2c9ffff9bf0a6bd62b6d1c29330e libk5crypto3_1.18.3-6+deb11u8+tuxcare.els1_armel.deb cc2fd9ce9ce469d37efe03edc29dce8d30a90f3a libkadm5clnt-mit12_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 9591b8cbd8bb7669937c1d3f8f44b110bc53deb0 libkadm5srv-mit12_1.18.3-6+deb11u8+tuxcare.els1_armel.deb f02f35f654a0e4b759c5425d46f471fd034dcfa8 libkdb5-10_1.18.3-6+deb11u8+tuxcare.els1_armel.deb cd7635e8de029396d0c28274c1f4d3cb54600ba1 libkrad-dev_1.18.3-6+deb11u8+tuxcare.els1_armel.deb c2bdc8c17051fee8da1cc2e57ccc722c2788c8db libkrad0_1.18.3-6+deb11u8+tuxcare.els1_armel.deb bade5eabc3482eb2a4a55f4a324e98c6c3f4a8f3 libkrb5-3_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 4740145ea63538069c95196002ad27e9b3bcbebb libkrb5-dev_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 34ad3fa7ddf9cb0d77a905a3b2ee5a1cd463440d libkrb5support0_1.18.3-6+deb11u8+tuxcare.els1_armel.deb 16f443a56ce6c25673399f8654b1793ef7bf4ef7 CLSA-2026:1788786535 TuxCare License Agreement 0 * SECURITY UPDATE: harden sudo against ROWHAMMER bit-flip attacks - debian/patches/CVE-2023-42465.patch: use ROWHAMMER-resistant values for ALLOW/DENY and the AUTH_* codes and explicitly test for expected values instead of negated tests in the parser and authentication code - CVE-2023-42465 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: harden sudo against ROWHAMMER bit-flip attacks - debian/patches/CVE-2023-42465.patch: use ROWHAMMER-resistant values for ALLOW/DENY and the AUTH_* codes and explicitly test for expected values instead of negated tests in the parser and authentication code - CVE-2023-42465

0 tuxcare-debian11-els sudo_1.9.5p2-3+deb11u4+tuxcare.els1_amd64.deb 734672c78afb03ba9740244da9cc47935beb5802 sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els1_amd64.deb 0f5fd763137956fbce053ba1240b7fc95e707945 sudo_1.9.5p2-3+deb11u4+tuxcare.els1_arm64.deb a754225b3e8731eb590f7022698c41e19a60450e sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els1_arm64.deb 1e5d2e5d2c439201d0ed9f112c5c11d9c6be858c sudo_1.9.5p2-3+deb11u4+tuxcare.els1_armel.deb bff28e6159d1a9baa84a2864e2bc12a009dfc72b sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els1_armel.deb 3f75c1aa9448addf3fa3fb137bbc2bb71196214a CLSA-2026:1788819939 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds read in the D-Bus introspection XML parser - debian/patches/CVE-2026-58016.patch: fix the inverted <node> nesting check in parser_start_element() in gio/gdbusintrospection.c, which accepted a <node> element inside <method>/<signal>/<property>/<arg> and left the parser reading X->pdata[X->len - 1] with len == 0 - CVE-2026-58016 * debian/rules: add arm to the qemu-buildd architecture list, raising test_timeout_multiplier from 5 to 20 on armel. Debian builds armel on real ARM hardware and so left it in the "slow architecture" tier, but this platform builds it under emulation, where the +slow suite exceeds the resulting 900s cap non-deterministically (gvariant 435s/262s/timeout, 642026 488s/501s/timeout across three runs of the same tree). No test is skipped and no other architecture is affected: arm64 and amd64 do not match the arm filter word. Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds read in the D-Bus introspection XML parser - debian/patches/CVE-2026-58016.patch: fix the inverted <node> nesting check in parser_start_element() in gio/gdbusintrospection.c, which accepted a <node> element inside <method>/<signal>/<property>/<arg> and left the parser reading X->pdata[X->len - 1] with len == 0 - CVE-2026-58016 * debian/rules: add arm to the qemu-buildd architecture list, raising test_timeout_multiplier from 5 to 20 on armel. Debian builds armel on real ARM hardware and so left it in the "slow architecture" tier, but this platform builds it under emulation, where the +slow suite exceeds the resulting 900s cap non-deterministically (gvariant 435s/262s/timeout, 642026 488s/501s/timeout across three runs of the same tree). No test is skipped and no other architecture is affected: arm64 and amd64 do not match the arm filter word.

0 tuxcare-debian11-els libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els1_amd64.deb efba27915bb52bd7a49636fba236ab5c1690be6d libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els1_amd64.deb 835998e6d8647c28870dc0235728c15ab51d2dca libglib2.0-data_2.66.8-1+deb11u8+tuxcare.els1_all.deb 9d746e27c94ff2bc05476043b0f810f4f9fc47a8 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els1_amd64.deb c1e23e905efc203d4dfc63e47c15e52e132f1396 libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els1_amd64.deb 2a8d0fd0e818e7805bc410849a6d6fcd2e6bdb97 libglib2.0-doc_2.66.8-1+deb11u8+tuxcare.els1_all.deb fde2c53f15cc8cb0f9f19c7662e0bff3715beb24 libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els1_amd64.deb cfc7e3f4138e52b155452a0384a3f85d8e762be6 libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els1_arm64.deb 08d0095dc806cdccb2269fe979ce94259f749aee libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els1_arm64.deb 972ec212b1641447efa516871d6bee0c763bdfc4 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els1_arm64.deb 11673ca4f833c3c7b563da31b7fb6714ca54364d libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els1_arm64.deb 1c988925b8aee66f167b015a34a8c7d6d2ff2eee libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els1_arm64.deb 6ae16fca16e0eaaba923d0cd060e2f58a75934f9 libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els1_armel.deb 37379d18658f26f6577ba8be2bf5b016a4147c48 libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els1_armel.deb ac0fa2279ba7f02fe0c0147d670466c45b9c6a3b libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els1_armel.deb 0e7a16e0a73a03d18b1ef0fc6c2e961f4bdee96b libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els1_armel.deb 2281f91ffa0d985c47d77b26a04269c3febeb4b3 libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els1_armel.deb 1d5f70b19bd8416fd83f5bac5686eda5953ac8a2 CLSA-2026:1788884663 TuxCare License Agreement 0 * SECURITY UPDATE: Fix HttpRequest use-after-free for ICP v3 queries - debian/patches/CVE-2026-32748.patch: move the icp_access check inside icpGetRequest() and return an HttpRequest::Pointer so the request survives the on-stack ACLFilledChecklist, eliminating the use-after-free in src/ICP.h, src/icp_v2.cc, src/icp_v3.cc and src/tests/stub_icp.cc - CVE-2026-32748 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Fix HttpRequest use-after-free for ICP v3 queries - debian/patches/CVE-2026-32748.patch: move the icp_access check inside icpGetRequest() and return an HttpRequest::Pointer so the request survives the on-stack ACLFilledChecklist, eliminating the use-after-free in src/ICP.h, src/icp_v2.cc, src/icp_v3.cc and src/tests/stub_icp.cc - CVE-2026-32748

0 tuxcare-debian11-els squid_4.13-10+deb11u7+tuxcare.els1_amd64.deb 0a5124f9f6550d30e61049da450d7b78c40ecb50 squid-cgi_4.13-10+deb11u7+tuxcare.els1_amd64.deb 38694ddbdce9c270fe07a21bb2f6aac723ac2975 squid-common_4.13-10+deb11u7+tuxcare.els1_all.deb e472738553fc1c3faf7c6f7b84cb67f88d48fc90 squid-openssl_4.13-10+deb11u7+tuxcare.els1_amd64.deb 523e9b4b31ff52e6a5767ddf778b2cb1927336e0 squid-purge_4.13-10+deb11u7+tuxcare.els1_amd64.deb d6926bb12e8907c2ab5b4921989945e0c0f9e662 squidclient_4.13-10+deb11u7+tuxcare.els1_amd64.deb d3131f93478a713ab15efb7e029818d7b0876649 squid_4.13-10+deb11u7+tuxcare.els1_arm64.deb e4ee2a693b172ff7e44f15d6acbbc5f4220dc15f squid-cgi_4.13-10+deb11u7+tuxcare.els1_arm64.deb f4a1e273f25e40e83a6a6d98439b9cfa4642e957 squid-openssl_4.13-10+deb11u7+tuxcare.els1_arm64.deb 0b37251cab1e3a49859f5b4efc111d87b6756f1c squid-purge_4.13-10+deb11u7+tuxcare.els1_arm64.deb 43f6a95a3cb8017d17d64efe962f8df21f7e6a5c squidclient_4.13-10+deb11u7+tuxcare.els1_arm64.deb 93660a1d7cb993b54d40fe412330113d6e10b5c6 squid_4.13-10+deb11u7+tuxcare.els1_armel.deb 9fe063625fd68b7feb31c0e65fac62ed2065db96 squid-cgi_4.13-10+deb11u7+tuxcare.els1_armel.deb fdd8e046b8ae089166df6601fc856cd6739297e7 squid-openssl_4.13-10+deb11u7+tuxcare.els1_armel.deb 296b547b68d939f862e6e3abfc1a47c7a2b50445 squid-purge_4.13-10+deb11u7+tuxcare.els1_armel.deb e8322b6d3c1c2836ff8f4ad7039fc3a588d8308c squidclient_4.13-10+deb11u7+tuxcare.els1_armel.deb 437912073f1b83b8cddfb9ee29ad938de89e0cd9 CLSA-2026:1788856712 TuxCare License Agreement 0 * SECURITY UPDATE: FCGI demux record length integer overflow - debian/patches/CVE-2026-55203.patch: widen fcgi_conn.drl from uint16_t to uint32_t in src/mux_fcgi.c to prevent drl += drp overflow to 0 - CVE-2026-55203 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: FCGI demux record length integer overflow - debian/patches/CVE-2026-55203.patch: widen fcgi_conn.drl from uint16_t to uint32_t in src/mux_fcgi.c to prevent drl += drp overflow to 0 - CVE-2026-55203

0 tuxcare-debian11-els haproxy_2.2.9-2+deb11u7+tuxcare.els2_amd64.deb 6641b6b40e3152a31c63394c98c3a3c490d41f58 haproxy-doc_2.2.9-2+deb11u7+tuxcare.els2_all.deb d4ddc910d8bc7e0229b1caabb65b362c132f48ed vim-haproxy_2.2.9-2+deb11u7+tuxcare.els2_all.deb 0449c62d41e98ac6adcde47e77ed4cd167a5c5d2 haproxy_2.2.9-2+deb11u7+tuxcare.els2_arm64.deb 6d2fdce88c537065ac97b3557a73aa95be371f3d haproxy_2.2.9-2+deb11u7+tuxcare.els2_armel.deb a8630223e18e1bf06c5d0af8e6547c58947e5b8b CLSA-2026:1788943086 TuxCare License Agreement 0 * SECURITY UPDATE: unchecked userauth input lengths let crafted username, password, hostname, method-name or public-key sizes wrap the packet-size arithmetic and produce an undersized heap allocation that is then overflowed - debian/patches/CVE-2026-7598.patch: cap every caller-supplied userauth input at MAX_INPUT_LEN before the allocation size is computed and return LIBSSH2_ERROR_OUT_OF_BOUNDARY instead, in userauth_list(), userauth_password(), userauth_hostbased_fromfile(), _libssh2_userauth_publickey() and userauth_keyboard_interactive() in src/userauth.c - CVE-2026-7598 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: unchecked userauth input lengths let crafted username, password, hostname, method-name or public-key sizes wrap the packet-size arithmetic and produce an undersized heap allocation that is then overflowed - debian/patches/CVE-2026-7598.patch: cap every caller-supplied userauth input at MAX_INPUT_LEN before the allocation size is computed and return LIBSSH2_ERROR_OUT_OF_BOUNDARY instead, in userauth_list(), userauth_password(), userauth_hostbased_fromfile(), _libssh2_userauth_publickey() and userauth_keyboard_interactive() in src/userauth.c - CVE-2026-7598

0 tuxcare-debian11-els libssh2-1_1.9.0-2+deb11u1+tuxcare.els1_amd64.deb 0750da30ea5e109898cab7b1dd8144212d52c13c libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els1_amd64.deb 5ddb5723676b18832817e16a3fbe1d7f69df60f3 libssh2-1_1.9.0-2+deb11u1+tuxcare.els1_arm64.deb d5480adc80128ccc90ade269f5860ec265520538 libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els1_arm64.deb eda5b8f852c181f18ea35e9fa13a7c5f1f10f45d libssh2-1_1.9.0-2+deb11u1+tuxcare.els1_armel.deb 55f5582394077d2a9f422068f0e0632494e2f06e libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els1_armel.deb afa83d5d0bc5382bcf58358dc6e8f2f8600853dc CLSA-2026:1788966943 TuxCare License Agreement 0 * SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets even when the target server supports stronger encryption - debian/patches/CVE-2022-45141.patch: select the TGS ticket enc-part key from the server's preferred key rather than from the session key, so a server supporting aes256-cts-hmac-sha1-96 is no longer handed an rc4-hmac ticket - CVE-2022-45141 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: AD DC can be forced to issue rc4-hmac Kerberos tickets even when the target server supports stronger encryption - debian/patches/CVE-2022-45141.patch: select the TGS ticket enc-part key from the server's preferred key rather than from the session key, so a server supporting aes256-cts-hmac-sha1-96 is no longer handed an rc4-hmac ticket - CVE-2022-45141

0 tuxcare-debian11-els ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 6e66632f0eb319963814f45600fbeb90fa9f8cbf libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 4d71069853832f1a069644ced024b386d023cb1f libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 5ad63ded5912529f1da0a053f04dd5ef7d87dd05 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 4ab2120dfc984b32d2fa133e7ff52c8db0775cde libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb b5ea6152a3a9ec960fa85c81600328feaad9fffd libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 0eecce909e3955fa05a5112402d668a96604127e libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 9f9b6ff0c52775ab3bb7c0258928b6fd1be375d0 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb d911ac2fd46effa8c93a675b7b5a27ed47fad5b3 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 5e0c3b7bb0d30b985ef637c81f59e57d485a86ad samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 8ab89051da81617a8172b6c77aa080be3cdd2aa4 samba-common_4.13.13+dfsg-1~deb11u8+tuxcare.els1_all.deb 27efdec3f184ab2ca85a6418729c9ae822d04cec samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 2e267092d104d2d755c7739d27761fcf0b798a49 samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb d1b4cdfd963cb1866b3eb35845cedfb05280e26b samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 6f26e921c77ce04bfdb18006b3a766c2b00799de samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 81a437cc529ff0d5ec1f480f0ecfe48b1130975a samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 93119e038191e8471fff4635d002db3c69300ad8 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb deff71eceaaf3e147ccd7559e24e3f6a4ff8f331 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 32f5c2e33d828d02985ef69f172ef56b53165c9f winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_amd64.deb 4e6fced5eb4e520dcf3d92fca893c9596d2ff311 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 535790a02e62cadb962232fa9dfcdb7124e031e0 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 374332f2323283ec2dad1b95475881eafd5755ea libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 167f8f96ff5e2132a242686e868d2a2a85e4fd3a libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb f806e542defbe3a7e46915984a7d91ad1ee3d019 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb fde0e8231c63f42f640368cf534e4b8ca6fa35e6 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb cb89d4e87c06a7dade66bfce6b7b62d8a2b0575b libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 26733f79947b04cc95b9b872df4e720096d066af python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb ddc97edfb41e19fa60e3bf00694b9107616e957a registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb a02e215060503da8d7d69a3ff8c514fdfcfc2692 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb f6eed3226e118081085a0f4d5f17529deef14e6f samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 9c043d90b5e348ff55c6843134995ec615921282 samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 38634b07242ab584fa8fa378e4c3472944391bf2 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb d698b7a9ca8e8128c09681b1a99b72b8ade72bc0 samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 3f4211cc367ee6023e794098d4438f59048cf3ea samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 0839b134db5cf9a736a0962806d721efde3bc857 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb ab79ef7fe4a2ffa00d98aff50a2d3aa27ae3cfad smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb c604818cc0fd88004b3304f549c2b69b34b6c9c4 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_arm64.deb 5f3568f87345b89aaff2c4579c823194fcd76bab ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 5e612b316870e61cd2b7fbffb46751d461d701d6 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb fa4670ac8b40c359b33af0f4afc578fbcda9683a libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 7e83f350192c31c1c7262312dffe8ef9e140b027 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb dfdcb9e5c58dc01dbda26d1ab4d1221fc650bd89 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb d85880b080c88748ccdb4a5c4848e4803429c832 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 75bcf6390652751fee73c3149afe6a1643e10a6b libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 82993586778ccf36b0088e151628b24df69dd46f python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb a0ff24aaf7d1a68f3c046ce04cbdf46795e57c2d registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 8792a2267fa2696937ee641d817bfc60888f5b8e samba_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 648c8867d5f81992668dc989e07b6b38c532a2d4 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 9de4ec0a53df336aba616fd0ba92d31b55a2f0fc samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb ae73d8c6f39d9c3a55a08aba4334c5c25a1a93d1 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb f977328b08223329d261939177e90c8722aa888c samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb e806d72856e71567e3c195febdc107abb362e5cd samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 669571bcf43e497cdf817b4e51baee12a29f61c2 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb d08031b9a9be47ed7f9c95753f76eed81c9a2678 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb f0e93ef69cda474ccd70264e793a0123d917a4cb winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els1_armel.deb 90f1efff71adffa652182a2ed2ecf8ee1ea92905 CLSA-2026:1788967622 TuxCare License Agreement 0 * SECURITY UPDATE: filter control characters from option values in the scheduler to prevent PPD keyword injection via Print-Job. - debian/patches/CVE-2026-34980.patch: filter out control characters from IPP option values in scheduler/job.c and allowlist-filter special PPD keywords in the CUPSD_LOG_PPD branch of update_job(); includes the upstream follow-ups for Issue #1532 (get_options() no longer loops forever on a value holding whitespace or a dropped control character), Issue #1562 (the allowlist advances its keyword pointer instead of testing keywords[0] repeatedly), Issue #1630 (whitespace stays backslash-escaped, so cupsParseOptions() in the filters no longer truncates option values containing spaces) and the case-insensitive keyword comparison that closes a "cupsfilter2" spelling bypass of the allowlist. - CVE-2026-34980. * Make the package testable on the ELS build nodes. None of these three changes is a CVE fix; the two patches are also carried by tuxcare-current/debian10els. - debian/patches/maxfds-limit.patch: cap MaxFDs at 65535 in scheduler/main.c, backported from upstream Issue #989 (beb84401c6698dfe937178d8ac8fa38505468dbb), so cupsd stops aborting at startup with "cupsdDoSelect() failed - Bad address!" on hosts whose RLIMIT_NOFILE hard limit is very large but not RLIM_INFINITY. - debian/patches/waiting-limit.patch: bound the "waiting for the scheduler" loop in test/run-stp-tests.sh at 60 seconds and take the test user from "id -un", so a scheduler that will not start fails the build with a diagnostic instead of hanging until the build system's 12 hour task limit. - debian/rules: hand test/run-stp-tests.sh a free TCP port instead of letting its cupsd default to 8631. CUPS_TESTBASE already keeps the config, spool, logs and domain socket of a run private, but pbuilder chroots share the host network namespace, so two cups builds on one node used to fight over that one port -- the second scheduler could not bind, the first answered its "lpstat -r" anyway, and both suites then drove a single cupsd, inflating every absolute count in the test summary. Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: filter control characters from option values in the scheduler to prevent PPD keyword injection via Print-Job. - debian/patches/CVE-2026-34980.patch: filter out control characters from IPP option values in scheduler/job.c and allowlist-filter special PPD keywords in the CUPSD_LOG_PPD branch of update_job(); includes the upstream follow-ups for Issue #1532 (get_options() no longer loops forever on a value holding whitespace or a dropped control character), Issue #1562 (the allowlist advances its keyword pointer instead of testing keywords[0] repeatedly), Issue #1630 (whitespace stays backslash-escaped, so cupsParseOptions() in the filters no longer truncates option values containing spaces) and the case-insensitive keyword comparison that closes a "cupsfilter2" spelling bypass of the allowlist. - CVE-2026-34980. * Make the package testable on the ELS build nodes. None of these three changes is a CVE fix; the two patches are also carried by tuxcare-current/debian10els. - debian/patches/maxfds-limit.patch: cap MaxFDs at 65535 in scheduler/main.c, backported from upstream Issue #989 (beb84401c6698dfe937178d8ac8fa38505468dbb), so cupsd stops aborting at startup with "cupsdDoSelect() failed - Bad address!" on hosts whose RLIMIT_NOFILE hard limit is very large but not RLIM_INFINITY. - debian/patches/waiting-limit.patch: bound the "waiting for the scheduler" loop in test/run-stp-tests.sh at 60 seconds and take the test user from "id -un", so a scheduler that will not start fails the build with a diagnostic instead of hanging until the build system's 12 hour task limit. - debian/rules: hand test/run-stp-tests.sh a free TCP port instead of letting its cupsd default to 8631. CUPS_TESTBASE already keeps the config, spool, logs and domain socket of a run private, but pbuilder chroots share the host network namespace, so two cups builds on one node used to fight over that one port -- the second scheduler could not bind, the first answered its "lpstat -r" anyway, and both suites then drove a single cupsd, inflating every absolute count in the test summary.

0 tuxcare-debian11-els cups_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb fbb9ba354235b9f04ecc8692de2ba59443c0eb03 cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb 08f9d5a8be12c15a606a40cbb69cd9f009345be2 cups-client_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb be98f84e6f37f15ca61e5010866cd93efa79e82c cups-common_2.3.3op2-3+deb11u10+tuxcare.els1_all.deb 1ccd52e6107c771fad929dcfaca9da038559b845 cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb cc3bb0eee972bac947093ee9f0a37ceb2c191995 cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb b9234314cd12d52a9720532a2fe1857d4c34d76a cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb 0046fde6d12b2db6a3f75bd3324b08ad5baf9f55 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb d35001926afb4d0ff19fa00b3e52957853936376 cups-server-common_2.3.3op2-3+deb11u10+tuxcare.els1_all.deb bc5991eea59c325b8640e466efe2f35a567d5034 libcups2_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb 901ad7dba8882d68a616c581e9db4a1a5c04e2ed libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb 5141f30ed894020698a89975dfc9f87085b347d2 libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb 2ae44de73f854e8edeac8f882bba838d0f1aaa57 libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_amd64.deb a97985b4afca62358565dce80d007df7aef8aae4 cups_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 0e0884123582b3edca2038d4ece19fcb350d61be cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb b1202905d852d7e3f396190e9fe0ab8fdb1222b8 cups-client_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 2ad5eac3ab0e1298a6b72c60c1c9fc524e356237 cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 08dd0f20bc4d3747b394b2a9c6d263f764b6e427 cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 9348217cc2abcb9e19e3197b312f0162865b2c5a cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb c31519d95e0f30a198b962f64b80493818ec1bc7 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb e395cc46fc3a626ac3ecaed1a3388e87eef23e03 libcups2_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb d93dc079f746caf3eb8882069c9174df3c051feb libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 13770f7dc50800e9c34fc8c6526234e57e664228 libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 0eb3c69bf308e88254c94df7de153cfb4e37a6b1 libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_arm64.deb 543280c711e117e739f719481f4d3dd65fb0dfa4 cups_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 838ac9f8b7e2a7e7d14464d551508c561e9ab7ee cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb cae5114aaea01a807146629f751995435813a2e5 cups-client_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 56c8832b0f9defaccb3431c8cc75d1f42b8921d9 cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 6ec54b30c122e68bd280873c4ca883105a9e5676 cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 34d16e9c7782dd3ee23657be2e7e09a2c6247d17 cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb dc5fc8fd623166d6799238360e3e86082e2ff7f9 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb aeb96897323a62a367aca6224e1170a64990f035 libcups2_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 8c9057db1dafcd869ba5b5b4ef1deda362c997d5 libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb fb2dd60e12c37a4814fd00d64362c1e8a187f5be libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 27385a67822af70a30dba523e1b56d054992e60b libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els1_armel.deb 697853173b2c5d38c338d9d3f4c70d8ad26d75fc CLSA-2026:1788968222 TuxCare License Agreement 0 * SECURITY UPDATE: Use-after-free because handler call depth tracking was absent entirely, leaving XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree, XML_ParserReset and XML_ResumeParser callable on the running parser from inside an application handler, and the XML_TOK_DATA_CHARS handler calls in doCdataSection() left untracked (libexpat before 2.8.2) - debian/patches/CVE-2026-56131.patch: introduce the handler call depth counter m_handlerCallDepth with the beforeHandler() / afterHandler() / isCalledFromInsideHandler() helpers from upstream PR #1246, wrap all 55 handler call sites in expat/lib/xmlparse.c, and reject the six affected entry points with XML_STATUS_ERROR / NULL when the counter is non-zero; XML_StopParser and XML_ExternalEntityParserCreate are deliberately left unguarded, as upstream intends. Also carries upstream PR #1278, which wraps the two doCdataSection XML_TOK_DATA_CHARS charDataHandler calls that the original framework missed and through which the depth guard was otherwise bypassable. Of the 55 wrapped call sites 53 are live; the other two sit inside expat's pre-existing "else if (0 && ...)" disabled branches, which upstream 2.8.2 wraps as well. Carries upstream's regression test into expat/tests/runtests.c. Behaviour change inherited from upstream: leaving a handler through a non-local exit, such as a C++ exception or longjmp(), skips afterHandler(), so the counter stays non-zero and every guarded entry point refuses from then on, XML_ParserFree() included. Upstream accepts the resulting leak in place of a use-after-free and provides no way to clear the counter - CVE-2026-56131 - CVE-2026-50219 - CVE-2026-56412 * SECURITY UPDATE: Quadratic runtime when detecting duplicate default attributes, allowing denial of service through a crafted DTD (libexpat before 2.8.1) - debian/patches/CVE-2026-45186.patch: add ELEMENT_TYPE.defaultAttsNames and resolve default-attribute collisions through a hash table lookup instead of a linear scan over defaultAtts in defineAttribute(), with matching hashTableInit()/hashTableDestroy() calls in storeAtts(), getElementType(), dtdCopy(), dtdReset() and dtdDestroy() in expat/lib/xmlparse.c. The trade-off, upstream's as well, is one hash table per element type: a constant extra amount of memory and setup work per element type and per tag, linear in document size, in exchange for removing the quadratic term - CVE-2026-45186 * SECURITY UPDATE: Integer overflow when reallocating the tag name conversion buffer (libexpat before 2.7.4) - debian/patches/CVE-2026-25210.patch: reject a doubling that would overflow before it happens (SIZE_MAX / 2 pre-check) and widen doContent()'s bufSize from int to size_t in expat/lib/xmlparse.c. Also carries the storeRawNames() half of upstream commit 25ec4f1b, which widens that function's bufSize and nameLen to size_t. Upstream released 25ec4f1b in 2.7.2, ahead of this fix in 2.7.4, and it is a prerequisite rather than cosmetics: once tag->buf is allowed past INT_MAX bytes, the (int) narrowing of convLen in doContent() can store a negative tag->name.strLen, and storeRawNames() would then compute a negative int bufSize, skip its reallocation and memcpy() below the buffer. Widened, the same value becomes a huge size_t, the reallocation fails and the function returns XML_FALSE, which is how upstream 2.7.4 behaves - CVE-2026-25210 * SECURITY UPDATE: Integer overflow in doProlog related to storeEntityValue and entity textLen (libexpat before 2.8.2) - debian/patches/CVE-2026-56407.patch: cap the entity value pool length against INT_MAX before assigning m_declEntity->textLen in expat/lib/xmlparse.c. The second hunk of upstream commit 30c2fc17 is omitted because it targets storeSelfEntityValue(), which arrived in expat 2.6.0 and does not exist here - CVE-2026-56407 * SECURITY UPDATE: Integer overflow in copyString (libexpat before 2.8.2) - debian/patches/CVE-2026-56408.patch: reject charsRequired > SIZE_MAX / sizeof(XML_Char) before the allocation in copyString() in expat/lib/xmlparse.c. This is upstream parity hardening rather than a live fix on 2.2.10: charsRequired is a size_t holding the length of the application-supplied encoding name rather than of document content, so tripping the guard would need a string larger than the address space even in the -DXML_UNICODE (buildw) library that debian/rules also builds, where sizeof(XML_Char) is 2 - CVE-2026-56408 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Use-after-free because handler call depth tracking was absent entirely, leaving XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree, XML_ParserReset and XML_ResumeParser callable on the running parser from inside an application handler, and the XML_TOK_DATA_CHARS handler calls in doCdataSection() left untracked (libexpat before 2.8.2) - debian/patches/CVE-2026-56131.patch: introduce the handler call depth counter m_handlerCallDepth with the beforeHandler() / afterHandler() / isCalledFromInsideHandler() helpers from upstream PR #1246, wrap all 55 handler call sites in expat/lib/xmlparse.c, and reject the six affected entry points with XML_STATUS_ERROR / NULL when the counter is non-zero; XML_StopParser and XML_ExternalEntityParserCreate are deliberately left unguarded, as upstream intends. Also carries upstream PR #1278, which wraps the two doCdataSection XML_TOK_DATA_CHARS charDataHandler calls that the original framework missed and through which the depth guard was otherwise bypassable. Of the 55 wrapped call sites 53 are live; the other two sit inside expat's pre-existing "else if (0 && ...)" disabled branches, which upstream 2.8.2 wraps as well. Carries upstream's regression test into expat/tests/runtests.c. Behaviour change inherited from upstream: leaving a handler through a non-local exit, such as a C++ exception or longjmp(), skips afterHandler(), so the counter stays non-zero and every guarded entry point refuses from then on, XML_ParserFree() included. Upstream accepts the resulting leak in place of a use-after-free and provides no way to clear the counter - CVE-2026-56131 - CVE-2026-50219 - CVE-2026-56412 * SECURITY UPDATE: Quadratic runtime when detecting duplicate default attributes, allowing denial of service through a crafted DTD (libexpat before 2.8.1) - debian/patches/CVE-2026-45186.patch: add ELEMENT_TYPE.defaultAttsNames and resolve default-attribute collisions through a hash table lookup instead of a linear scan over defaultAtts in defineAttribute(), with matching hashTableInit()/hashTableDestroy() calls in storeAtts(), getElementType(), dtdCopy(), dtdReset() and dtdDestroy() in expat/lib/xmlparse.c. The trade-off, upstream's as well, is one hash table per element type: a constant extra amount of memory and setup work per element type and per tag, linear in document size, in exchange for removing the quadratic term - CVE-2026-45186 * SECURITY UPDATE: Integer overflow when reallocating the tag name conversion buffer (libexpat before 2.7.4) - debian/patches/CVE-2026-25210.patch: reject a doubling that would overflow before it happens (SIZE_MAX / 2 pre-check) and widen doContent()'s bufSize from int to size_t in expat/lib/xmlparse.c. Also carries the storeRawNames() half of upstream commit 25ec4f1b, which widens that function's bufSize and nameLen to size_t. Upstream released 25ec4f1b in 2.7.2, ahead of this fix in 2.7.4, and it is a prerequisite rather than cosmetics: once tag->buf is allowed past INT_MAX bytes, the (int) narrowing of convLen in doContent() can store a negative tag->name.strLen, and storeRawNames() would then compute a negative int bufSize, skip its reallocation and memcpy() below the buffer. Widened, the same value becomes a huge size_t, the reallocation fails and the function returns XML_FALSE, which is how upstream 2.7.4 behaves - CVE-2026-25210 * SECURITY UPDATE: Integer overflow in doProlog related to storeEntityValue and entity textLen (libexpat before 2.8.2) - debian/patches/CVE-2026-56407.patch: cap the entity value pool length against INT_MAX before assigning m_declEntity->textLen in expat/lib/xmlparse.c. The second hunk of upstream commit 30c2fc17 is omitted because it targets storeSelfEntityValue(), which arrived in expat 2.6.0 and does not exist here - CVE-2026-56407 * SECURITY UPDATE: Integer overflow in copyString (libexpat before 2.8.2) - debian/patches/CVE-2026-56408.patch: reject charsRequired > SIZE_MAX / sizeof(XML_Char) before the allocation in copyString() in expat/lib/xmlparse.c. This is upstream parity hardening rather than a live fix on 2.2.10: charsRequired is a size_t holding the length of the application-supplied encoding name rather than of document content, so tripping the guard would need a string larger than the address space even in the -DXML_UNICODE (buildw) library that debian/rules also builds, where sizeof(XML_Char) is 2 - CVE-2026-56408

0 tuxcare-debian11-els expat_2.2.10-2+deb11u7+tuxcare.els1_amd64.deb d99b5124a201d5dd0010e21a29abc0c4dad9dcdf libexpat1_2.2.10-2+deb11u7+tuxcare.els1_amd64.deb 95901b68e8442d788bedafff81d160d3ef4e89e7 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els1_amd64.deb 8111fa7ab45f99b2737ea67fa0d462e644c5ee86 expat_2.2.10-2+deb11u7+tuxcare.els1_arm64.deb 3c70e47086380e6f3854d7d86ffe81f1406241ba libexpat1_2.2.10-2+deb11u7+tuxcare.els1_arm64.deb 27c68313edd6d6fa28cffebbc59cd7ee137c0cae libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els1_arm64.deb 086b1cf465928af327e9aee469745553e71cf55d expat_2.2.10-2+deb11u7+tuxcare.els1_armel.deb e2b03a9ca103397722cbdc8957771a7546a5ced9 libexpat1_2.2.10-2+deb11u7+tuxcare.els1_armel.deb 88388dc17478d70e626d4542596923414e8f0e4b libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els1_armel.deb 85c527f69324f573fc7fc5344fc252db4e9c104a CLSA-2026:1789049274 TuxCare License Agreement 0 * SECURITY UPDATE: Lua VM re-entry when a resync payload is processed while a timed-out script is still on the stack - debian/patches/0027-CVE-2026-23631.patch: return early from readSyncBulkPayload() in src/replication.c while server.lua_timedout is set, so rdbLoadRio() cannot reach luaCreateFunction() on the lua_State that is paused inside the running script. Backport of upstream redis commit 80c2b5a0a, substituting server.lua_timedout for the 7.0 isInsideYieldingLongCommand() helper. Applied as defence in depth: the use-after-free CVE-2026-23631 describes is not reachable on 6.0.16, where scriptingReset() is reached only via SCRIPT FLUSH and not from the resync path. - CVE-2026-23631 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Lua VM re-entry when a resync payload is processed while a timed-out script is still on the stack - debian/patches/0027-CVE-2026-23631.patch: return early from readSyncBulkPayload() in src/replication.c while server.lua_timedout is set, so rdbLoadRio() cannot reach luaCreateFunction() on the lua_State that is paused inside the running script. Backport of upstream redis commit 80c2b5a0a, substituting server.lua_timedout for the 7.0 isInsideYieldingLongCommand() helper. Applied as defence in depth: the use-after-free CVE-2026-23631 describes is not reachable on 6.0.16, where scriptingReset() is reached only via SCRIPT FLUSH and not from the resync path. - CVE-2026-23631

0 tuxcare-debian11-els redis_6.0.16-1+deb11u9+tuxcare.els1_all.deb 9b50592ff252ed7d9512cd71b19d1c6948f5fcad redis-sentinel_6.0.16-1+deb11u9+tuxcare.els1_amd64.deb a2407abbeaaec7b6cfff80dc7d1d28140e346a8a redis-server_6.0.16-1+deb11u9+tuxcare.els1_amd64.deb 7acc95c85e936296d83ac224cb11667e52c635a9 redis-tools_6.0.16-1+deb11u9+tuxcare.els1_amd64.deb 7c60dd54a052a25055e5cb9200570f0de6ec2869 redis-sentinel_6.0.16-1+deb11u9+tuxcare.els1_arm64.deb 6bbb067b7e08e63f1d92fda91cd6be293be73688 redis-server_6.0.16-1+deb11u9+tuxcare.els1_arm64.deb f8f59de164fe60b2d5aefed5ced686e9dffd8fcf redis-tools_6.0.16-1+deb11u9+tuxcare.els1_arm64.deb 217fd4efa6bfa85deaa164ca633436f77e0aecb6 redis-sentinel_6.0.16-1+deb11u9+tuxcare.els1_armel.deb 2af287868a0b639084b606e5d10c83a9a620002e redis-server_6.0.16-1+deb11u9+tuxcare.els1_armel.deb 7b9bb10b12dc917f5f5e501d779d92dddd6dd345 redis-tools_6.0.16-1+deb11u9+tuxcare.els1_armel.deb c7c86059bdad6e0547e1db82a777e38fca4769ba CLSA-2026:1789116242 TuxCare License Agreement 0 * SECURITY UPDATE: Double free in another_hunk() via pch_swap() - debian/patches/CVE-2018-6952.patch: in pch_swap(), src/pch.c, derive the non-freeable pointer range shift from p_ptrn_lines instead of the already-incremented line index, so p_bfake/p_efake keep bracketing the aliased fill lines after a swap. With a blank line in the middle of a context-diff hunk the range was off by one and the next another_hunk() call freed an aliased line twice - CVE-2018-6952 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Double free in another_hunk() via pch_swap() - debian/patches/CVE-2018-6952.patch: in pch_swap(), src/pch.c, derive the non-freeable pointer range shift from p_ptrn_lines instead of the already-incremented line index, so p_bfake/p_efake keep bracketing the aliased fill lines after a swap. With a blank line in the middle of a context-diff hunk the range was off by one and the next another_hunk() call freed an aliased line twice - CVE-2018-6952

0 tuxcare-debian11-els patch_2.7.6-7+tuxcare.els1_amd64.deb 6b49b38eaa79925246abaabae55d81ecfff6610d patch_2.7.6-7+tuxcare.els1_arm64.deb ba11eaf135f5202fc34bda4b52c006c532aaca4e patch_2.7.6-7+tuxcare.els1_armel.deb 88522183ea27e331f54477f5ae363318c3fd6306 CLSA-2026:1789142195 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read in DNS name escape decoding when running against musl libc - debian/patches/CVE-2026-40684.patch: rewrite the escape-decoding loop of string_copy_dnsdomain() to consume one, two or three digits as available instead of blindly indexing s[1], s[2], s[3] and advancing four bytes, and drop the second pointer advance in the non-digit branch so a trailing lone backslash cannot read past the terminating NUL - CVE-2026-40684 * SECURITY UPDATE: heap out-of-bounds write in JSON string expansions - debian/patches/CVE-2026-40685.patch: in dewrap(), only skip a backslash when a non-NUL character follows it, so a value ending in a single trailing backslash can no longer walk past the end of the string and write beyond the destination buffer - CVE-2026-40685 * SECURITY UPDATE: heap read past the end of the input in UTF-8 expansion operators, allowing data exfiltration through an SMTP rejection message - debian/patches/CVE-2026-40686.patch: stop the continuation-byte loop of the GETUTF8INC macro at the terminating NUL, so malformed UTF-8 that declares more continuation bytes than are present no longer reads into adjacent heap - CVE-2026-40686 * SECURITY UPDATE: uninitialised-memory disclosure and static buffer overflows in the SPA (NTLM) authenticator - debian/patches/CVE-2026-40687.patch: zero the output buffer at the top of spa_base64_to_bits() so a short encoded input no longer leaves previous heap contents in the SPA challenge/response flow, and replace the assert() guards in unicodeToString(), strToUnicode() and toString() with explicit length clamping, since assert() compiles away under NDEBUG and leaves an unchecked write past the end of the 1024-byte static buffers; also clamp the length used by the spa_unicode_add_string macro, which states the truncation contract at the call site (spa_bytes_add() already bounds-checks the copy itself) - CVE-2026-40687 * SECURITY UPDATE: directory traversal outside the spool area through mishandled named-queue arguments, leading to privilege escalation - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG <name> and -q[f][f][l]G<name>, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller - CVE-2026-66140 * SECURITY UPDATE: .forward privilege escalation caused by expansion of the pipe command under force_command - debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges - CVE-2026-66141 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read in DNS name escape decoding when running against musl libc - debian/patches/CVE-2026-40684.patch: rewrite the escape-decoding loop of string_copy_dnsdomain() to consume one, two or three digits as available instead of blindly indexing s[1], s[2], s[3] and advancing four bytes, and drop the second pointer advance in the non-digit branch so a trailing lone backslash cannot read past the terminating NUL - CVE-2026-40684 * SECURITY UPDATE: heap out-of-bounds write in JSON string expansions - debian/patches/CVE-2026-40685.patch: in dewrap(), only skip a backslash when a non-NUL character follows it, so a value ending in a single trailing backslash can no longer walk past the end of the string and write beyond the destination buffer - CVE-2026-40685 * SECURITY UPDATE: heap read past the end of the input in UTF-8 expansion operators, allowing data exfiltration through an SMTP rejection message - debian/patches/CVE-2026-40686.patch: stop the continuation-byte loop of the GETUTF8INC macro at the terminating NUL, so malformed UTF-8 that declares more continuation bytes than are present no longer reads into adjacent heap - CVE-2026-40686 * SECURITY UPDATE: uninitialised-memory disclosure and static buffer overflows in the SPA (NTLM) authenticator - debian/patches/CVE-2026-40687.patch: zero the output buffer at the top of spa_base64_to_bits() so a short encoded input no longer leaves previous heap contents in the SPA challenge/response flow, and replace the assert() guards in unicodeToString(), strToUnicode() and toString() with explicit length clamping, since assert() compiles away under NDEBUG and leaves an unchecked write past the end of the 1024-byte static buffers; also clamp the length used by the spa_unicode_add_string macro, which states the truncation contract at the call site (spa_bytes_add() already bounds-checks the copy itself) - CVE-2026-40687 * SECURITY UPDATE: directory traversal outside the spool area through mishandled named-queue arguments, leading to privilege escalation - debian/patches/CVE-2026-66140.patch: add validate_queue_name() and apply it to both command-line sources of a queue name, -MCG <name> and -q[f][f][l]G<name>, rejecting a name that contains '/', is longer than 32 characters, or collides with one of the reserved spool subdirectories input, db, msglog and scan; mark -MC and every -MCx argument as admin-only and refuse them for a non-admin caller - CVE-2026-66140 * SECURITY UPDATE: .forward privilege escalation caused by expansion of the pipe command under force_command - debian/patches/CVE-2026-66141.patch: stop passing addr->local_part through expand_string() in the $address_pipe special case of a pipe transport that has force_command set, so command text supplied by a local user in a .forward file is only dequoted and split into arguments instead of being evaluated with the transport's privileges - CVE-2026-66141

0 tuxcare-debian11-els exim4_4.94.2-7+deb11u6+tuxcare.els1_all.deb 168aa7d71185e2ab27c69fd434a8ebbf3e02da1a exim4-base_4.94.2-7+deb11u6+tuxcare.els1_amd64.deb d6b6512742f4bc968da5e83a9c6c15dc8263eab2 exim4-config_4.94.2-7+deb11u6+tuxcare.els1_all.deb 3e933d8b8247f5819d2e5a40ee9a21e7829dc36f exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els1_amd64.deb c222be54939d3a19b2646a7c49a2ffe5873635a4 exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els1_amd64.deb 7f5e8477e9a352fe8e93cd692233560bec978176 exim4-dev_4.94.2-7+deb11u6+tuxcare.els1_amd64.deb 1a922fb8921290ffb4b03bbc9663efaafdec0bfa eximon4_4.94.2-7+deb11u6+tuxcare.els1_amd64.deb 511f239520ead5e18f270e50d27afb24c01da7bb exim4-base_4.94.2-7+deb11u6+tuxcare.els1_arm64.deb 06e1ebc4db6c80d4c80c2ee041c3fc95d2e109ea exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els1_arm64.deb 826fbfc1be9e11f16153f7766aaeaae671f3d7df exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els1_arm64.deb 01063f18fb063f556459928e89df94c8654d374a exim4-dev_4.94.2-7+deb11u6+tuxcare.els1_arm64.deb 715f726227e82cdaa4f9d99585af552381a14ee6 eximon4_4.94.2-7+deb11u6+tuxcare.els1_arm64.deb 8e44745b50b74d99cf4491bfef37c354b6f69844 exim4-base_4.94.2-7+deb11u6+tuxcare.els1_armel.deb b9e83f1778bec8616779e085b3f1a88081bd31e0 exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els1_armel.deb d00992b0907e95e992aa445789d3da94a94b9fd3 exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els1_armel.deb 81c4bc5ad097606a9c0a06079934373578b5ce20 exim4-dev_4.94.2-7+deb11u6+tuxcare.els1_armel.deb 20b09eb93f831c5065aa927db3a0bba63e06e89c eximon4_4.94.2-7+deb11u6+tuxcare.els1_armel.deb 654620ada40ebb5c61bfa439e32f021fc8e36ad0 CLSA-2026:1789202428 TuxCare License Agreement 0 * SECURITY UPDATE - CVE-2018-1000500: missing TLS certificate verification in spawn_https_helper_openssl() - CVE-2021-42383: use-after-free in evaluate() on field concatenation - CVE-2022-28391: terminal escape injection in sockaddr2str() and nslookup parse_reply() - CVE-2023-39810: directory traversal in data_extract_all() * debian/config/pkg/{deb,static,udeb}: FEATURE_PATH_TRAVERSAL_PROTECTION=y, the CVE-2023-39810 guard is compiled out without it * debian/testsuite-linux.diff: disable the cpio uid/gid test, it is environment dependent and fails the same way on an unpatched tree Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE - CVE-2018-1000500: missing TLS certificate verification in spawn_https_helper_openssl() - CVE-2021-42383: use-after-free in evaluate() on field concatenation - CVE-2022-28391: terminal escape injection in sockaddr2str() and nslookup parse_reply() - CVE-2023-39810: directory traversal in data_extract_all() * debian/config/pkg/{deb,static,udeb}: FEATURE_PATH_TRAVERSAL_PROTECTION=y, the CVE-2023-39810 guard is compiled out without it * debian/testsuite-linux.diff: disable the cpio uid/gid test, it is environment dependent and fails the same way on an unpatched tree

0 tuxcare-debian11-els busybox_1.30.1-6+deb11u1+tuxcare.els1_amd64.deb fcd1d70fea1f9bab078ecaee2536ae6365a0bfde busybox-static_1.30.1-6+deb11u1+tuxcare.els1_amd64.deb abea1b5a17a15e66b4268a66f623dc1068d38850 busybox-syslogd_1.30.1-6+deb11u1+tuxcare.els1_all.deb 58be69e203716eb41fee133ce85b57b2ed451ab1 udhcpc_1.30.1-6+deb11u1+tuxcare.els1_amd64.deb b763a78543d55ae5fc76747500921c61b6db40b7 udhcpd_1.30.1-6+deb11u1+tuxcare.els1_amd64.deb 3806e168eb8b71e2fcdc8946407afd069cad1e15 busybox_1.30.1-6+deb11u1+tuxcare.els1_arm64.deb c6ea458c3b3f718565f01fc6420d2050efffe4d8 busybox-static_1.30.1-6+deb11u1+tuxcare.els1_arm64.deb 4a44df8b9f4fd2b13b347d0186653595ebb135dc udhcpc_1.30.1-6+deb11u1+tuxcare.els1_arm64.deb 50ddf068f7cab42b8b4e2f4fb788aa1862385e51 udhcpd_1.30.1-6+deb11u1+tuxcare.els1_arm64.deb 13bd82029c2586e16cf4799da3ee68db2083435b busybox_1.30.1-6+deb11u1+tuxcare.els1_armel.deb 93621a725dc7a860e908970aa04351722716b80f busybox-static_1.30.1-6+deb11u1+tuxcare.els1_armel.deb c49a699b47ff5f1b9a0fd37f3aa484dc716ac1f0 udhcpc_1.30.1-6+deb11u1+tuxcare.els1_armel.deb 747ae6ce6aff4e481e307719fa289dd81f9998c3 udhcpd_1.30.1-6+deb11u1+tuxcare.els1_armel.deb ed73947072e965bb5537bff8faf23440cddc43e7 CLSA-2026:1789205560 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read in the LZH decoder - debian/patches/CVE-2026-41992.patch: clear left, right and c_table in huf_decode_start() in unlzh.c - CVE-2026-41992 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read in the LZH decoder - debian/patches/CVE-2026-41992.patch: clear left, right and c_table in huf_decode_start() in unlzh.c - CVE-2026-41992

0 tuxcare-debian11-els gzip_1.10-4+deb11u1+tuxcare.els1_amd64.deb a8d07c9d13154e147650e93d9841a13093a2fd28 gzip-win32_1.10-4+deb11u1+tuxcare.els1_all.deb 7f2d83f609bec5890330d231899ee345fbd04283 gzip_1.10-4+deb11u1+tuxcare.els1_arm64.deb 79aec2959d70d8320894e088770fedc43375ee05 gzip_1.10-4+deb11u1+tuxcare.els1_armel.deb c5c8e7f000d02767c7bdaa2a43ecb6043c9dd626 CLSA-2026:1789205759 TuxCare License Agreement 0 * SECURITY UPDATE: unchecked 32-bit attribute count from a publickey subsystem response is multiplied by the attribute size without a bounds check, so on 32-bit builds the product wraps to an undersized allocation that the parsing loop then overflows - debian/patches/CVE-2026-58050.patch: cap the attribute count at 1024 and fail with LIBSSH2_ERROR_OUT_OF_BOUNDARY before the allocation, and zero-initialise the freshly reallocated list entry so the new error path cannot free uninitialised attrs/packet pointers in libssh2_publickey_list_free(), in libssh2_publickey_list_fetch() in src/publickey.c - CVE-2026-58050 * SECURITY UPDATE: double free in sftp_open() lets a malicious SSH server corrupt the heap of an authenticated client opening an SFTP session - debian/patches/CVE-2026-66032.patch: set data to NULL after freeing the SSH_FXP_STATUS response buffer on the FX_OK path, so the if(badness) arm cannot free the same pointer a second time when the follow-up sftp_packet_require() for SSH_FXP_HANDLE fails, in sftp_open() in src/sftp.c - CVE-2026-66032 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: unchecked 32-bit attribute count from a publickey subsystem response is multiplied by the attribute size without a bounds check, so on 32-bit builds the product wraps to an undersized allocation that the parsing loop then overflows - debian/patches/CVE-2026-58050.patch: cap the attribute count at 1024 and fail with LIBSSH2_ERROR_OUT_OF_BOUNDARY before the allocation, and zero-initialise the freshly reallocated list entry so the new error path cannot free uninitialised attrs/packet pointers in libssh2_publickey_list_free(), in libssh2_publickey_list_fetch() in src/publickey.c - CVE-2026-58050 * SECURITY UPDATE: double free in sftp_open() lets a malicious SSH server corrupt the heap of an authenticated client opening an SFTP session - debian/patches/CVE-2026-66032.patch: set data to NULL after freeing the SSH_FXP_STATUS response buffer on the FX_OK path, so the if(badness) arm cannot free the same pointer a second time when the follow-up sftp_packet_require() for SSH_FXP_HANDLE fails, in sftp_open() in src/sftp.c - CVE-2026-66032

0 tuxcare-debian11-els libssh2-1_1.9.0-2+deb11u1+tuxcare.els2_amd64.deb 6ed0b695ae96bd2859c9406788a4bb0ce1b6bc38 libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els2_amd64.deb 158f9ce707b71155b99d0b1f67053d38a8c439b8 libssh2-1_1.9.0-2+deb11u1+tuxcare.els2_arm64.deb e2461d1a73ccb256cffa71c564df53dfc8db6757 libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els2_arm64.deb 33ff8d9d92b8c401951bcd70d37904a7bc8eda9b libssh2-1_1.9.0-2+deb11u1+tuxcare.els2_armel.deb 608f9b45499bb91d413ac3e697d6d95748065716 libssh2-1-dev_1.9.0-2+deb11u1+tuxcare.els2_armel.deb e98584666670ea998b1e1162084d4fc74e899571 CLSA-2026:1789206875 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read when undo makes the Visual area invalid - debian/patches/CVE-2022-0368.patch: correct the Visual area after undo in src/undo.c, add test to src/testdir/test_visual.vim. - CVE-2022-0368 * SECURITY UPDATE: buffer overflow in the spell suggest code after invalid bytes are added with :spellgood - debian/patches/CVE-2022-1621.patch: reject words that are not a valid utf-8 string in store_word() and spell_add_word() in src/spellfile.c, add the E1280 message to src/errors.h, build utf_valid_string() when FEAT_SPELL is enabled in src/mbyte.c, add test to src/testdir/test_spell_utf8.vim. - CVE-2022-1621 * SECURITY UPDATE: buffer over-read on a trailing escape character in quote text objects - debian/patches/CVE-2022-1629.patch: check for NUL after the escape character in find_next_quote() in src/textobject.c, add test to src/testdir/test_textobjects.vim. - CVE-2022-1629 * SECURITY UPDATE: heap buffer overflow when text is changed in Visual mode - debian/patches/CVE-2022-1735.patch: revalidate the Visual start position after a buffer change; add check_visual_pos() in src/misc2.c, src/proto/misc2.pro and call it from changed_common() in src/change.c and stop_insert() in src/edit.c; add test to src/testdir/test_visual.vim. - CVE-2022-1735 * SECURITY UPDATE: use-after-free when searching for a pattern in path - debian/patches/CVE-2022-1968.patch: copy the buffer line into the file_line buffer before matching in find_pattern_in_path(), in src/search.c; add test in src/testdir/test_tagjump.vim. - CVE-2022-1968 * SECURITY UPDATE: heap buffer over-read with a line-zero address ("0;'(") - debian/patches/CVE-2022-2182.patch: check that the cursor column is valid for line one when the address is zero, in parse_cmd_address() in src/ex_docmd.c; add regression test in src/testdir/test_cmdline.vim. - CVE-2022-2182 * SECURITY UPDATE: out-of-bounds read with a menu item consisting of only a modifier - debian/patches/CVE-2022-2257.patch: check for NUL before advancing past the end of the string in str2special() in src/message.c, add test to src/testdir/test_menu.vim. - CVE-2022-2257 * SECURITY UPDATE: Ex command injection in netrw remote file browsing - debian/patches/CVE-2026-55895.patch: use fnameescape() on the buffer name before passing it to :execute in s:NetrwBrowse() in runtime/autoload/netrw.vim. - CVE-2026-55895 * SECURITY UPDATE: arbitrary code execution via a crafted doc string in python omni-completion - debian/patches/CVE-2026-57456.patch: quote reconstructed doc strings with repr() instead of pasting them between literal triple quotes, in the Scope, Class and Function get_code() methods in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim. - CVE-2026-57456 * SECURITY UPDATE: arbitrary Ex command execution during C omni-completion - debian/patches/CVE-2026-59858.patch: escape the tags typeref/typename field with escape(typename, '/\') before interpolating it into the :vimgrep pattern in s:StructMembers() in runtime/autoload/ccomplete.vim; add test in src/testdir/test_plugin_ccomplete.vim, src/testdir/Make_all.mak. - CVE-2026-59858 * Fix the failing Test_terminal_cwd() - debian/patches/fix-Test_terminal_cwd.patch: join two lines to prevent fail on a long pathname * Fix the failing Test_quit_long_message() - debian/patches/fix-Test_quit_long_message.patch: wait for the more prompt instead of the ruler and dump 10 screen rows, so a long build pathname in the error message does not overflow the test terminal * Fix the tests that fail when the package is built as root - debian/patches/fix-tests-run-as-root.patch: guard the four permission-dependent tests with CheckNotRoot, splitting the read-only cases of Test_redir_cmd() and Test_helptag_cmd() into their own tests * Fix the tests that fail on the timing of the arm builders - debian/patches/fix-mouse-click-test-timing.patch: raise 'mousetime' in the two multiple-click mouse tests - debian/patches/fix-tests-tolerate-flaky-giveup.patch: add $TEST_MAY_FAIL_FLAKY, set by debian/rules on the non-amd64 targets, to report a given-up flaky test instead of failing the build - debian/patches/fix-tests-stray-swapfiles.patch: drop leftover scratch swap files between test files, so E325 cannot cascade Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read when undo makes the Visual area invalid - debian/patches/CVE-2022-0368.patch: correct the Visual area after undo in src/undo.c, add test to src/testdir/test_visual.vim. - CVE-2022-0368 * SECURITY UPDATE: buffer overflow in the spell suggest code after invalid bytes are added with :spellgood - debian/patches/CVE-2022-1621.patch: reject words that are not a valid utf-8 string in store_word() and spell_add_word() in src/spellfile.c, add the E1280 message to src/errors.h, build utf_valid_string() when FEAT_SPELL is enabled in src/mbyte.c, add test to src/testdir/test_spell_utf8.vim. - CVE-2022-1621 * SECURITY UPDATE: buffer over-read on a trailing escape character in quote text objects - debian/patches/CVE-2022-1629.patch: check for NUL after the escape character in find_next_quote() in src/textobject.c, add test to src/testdir/test_textobjects.vim. - CVE-2022-1629 * SECURITY UPDATE: heap buffer overflow when text is changed in Visual mode - debian/patches/CVE-2022-1735.patch: revalidate the Visual start position after a buffer change; add check_visual_pos() in src/misc2.c, src/proto/misc2.pro and call it from changed_common() in src/change.c and stop_insert() in src/edit.c; add test to src/testdir/test_visual.vim. - CVE-2022-1735 * SECURITY UPDATE: use-after-free when searching for a pattern in path - debian/patches/CVE-2022-1968.patch: copy the buffer line into the file_line buffer before matching in find_pattern_in_path(), in src/search.c; add test in src/testdir/test_tagjump.vim. - CVE-2022-1968 * SECURITY UPDATE: heap buffer over-read with a line-zero address ("0;'(") - debian/patches/CVE-2022-2182.patch: check that the cursor column is valid for line one when the address is zero, in parse_cmd_address() in src/ex_docmd.c; add regression test in src/testdir/test_cmdline.vim. - CVE-2022-2182 * SECURITY UPDATE: out-of-bounds read with a menu item consisting of only a modifier - debian/patches/CVE-2022-2257.patch: check for NUL before advancing past the end of the string in str2special() in src/message.c, add test to src/testdir/test_menu.vim. - CVE-2022-2257 * SECURITY UPDATE: Ex command injection in netrw remote file browsing - debian/patches/CVE-2026-55895.patch: use fnameescape() on the buffer name before passing it to :execute in s:NetrwBrowse() in runtime/autoload/netrw.vim. - CVE-2026-55895 * SECURITY UPDATE: arbitrary code execution via a crafted doc string in python omni-completion - debian/patches/CVE-2026-57456.patch: quote reconstructed doc strings with repr() instead of pasting them between literal triple quotes, in the Scope, Class and Function get_code() methods in runtime/autoload/python3complete.vim and runtime/autoload/pythoncomplete.vim. - CVE-2026-57456 * SECURITY UPDATE: arbitrary Ex command execution during C omni-completion - debian/patches/CVE-2026-59858.patch: escape the tags typeref/typename field with escape(typename, '/\') before interpolating it into the :vimgrep pattern in s:StructMembers() in runtime/autoload/ccomplete.vim; add test in src/testdir/test_plugin_ccomplete.vim, src/testdir/Make_all.mak. - CVE-2026-59858 * Fix the failing Test_terminal_cwd() - debian/patches/fix-Test_terminal_cwd.patch: join two lines to prevent fail on a long pathname * Fix the failing Test_quit_long_message() - debian/patches/fix-Test_quit_long_message.patch: wait for the more prompt instead of the ruler and dump 10 screen rows, so a long build pathname in the error message does not overflow the test terminal * Fix the tests that fail when the package is built as root - debian/patches/fix-tests-run-as-root.patch: guard the four permission-dependent tests with CheckNotRoot, splitting the read-only cases of Test_redir_cmd() and Test_helptag_cmd() into their own tests * Fix the tests that fail on the timing of the arm builders - debian/patches/fix-mouse-click-test-timing.patch: raise 'mousetime' in the two multiple-click mouse tests - debian/patches/fix-tests-tolerate-flaky-giveup.patch: add $TEST_MAY_FAIL_FLAKY, set by debian/rules on the non-amd64 targets, to report a given-up flaky test instead of failing the build - debian/patches/fix-tests-stray-swapfiles.patch: drop leftover scratch swap files between test files, so E325 cannot cascade

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb 2f9b74c2038ac8279865c6634aeb78222eb79d71 vim-athena_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb bc636f9b7647a44050b7ebc3a665540b53830df8 vim-common_8.2.2434-3+deb11u3+tuxcare.els3_all.deb cbc4a0ae5eaec7600335e08e30b64418e7c3a179 vim-doc_8.2.2434-3+deb11u3+tuxcare.els3_all.deb cf663ca38c0e6c12a1f90f39bfa46d73e79e5874 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els3_all.deb 5a6e7261db220f0515d06e7bdd17043d2905666a vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb ac9ebfea9238077fb0be50f1503384682c11324a vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els3_all.deb 68d26e922102dfdad9be082a113dfb5b6de81368 vim-nox_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb bad169d6ab4edf120e46f0b294111eee3d7f0699 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els3_all.deb 4fcd820b94dc6faae699eefa153f56b07e261775 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb e1c05798f06b527dc249e7d74534129f0cb41867 xxd_8.2.2434-3+deb11u3+tuxcare.els3_amd64.deb 9abebee58277c7dd4917b0e8a877e59ecbca11a4 vim_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb d743b9fc901b79adfa7aa0770ca019e7681909de vim-athena_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb c6cfadb33994b152fa27978e0bd6a3964e42b016 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb fa972438b6fdba18efab2f6502797b0c8d10a372 vim-nox_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb 00fb23ff6167a02cb6b2c4dda75a09cef6e30eca vim-tiny_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb 17a8f9900050e68ff6935f37995d92ae9d5bd548 xxd_8.2.2434-3+deb11u3+tuxcare.els3_arm64.deb 0ee653608d33a5992ac90cf48700c5f20f8f54aa vim_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb 2fc0ff2dba005b9fdc75704f74157254e3c21c44 vim-athena_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb b4fbfc2d493d026abb1399c4873e633245160f61 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb 871b1fce97b986c3d81e88a1cd49913670e7a641 vim-nox_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb 5fc5c73ca751a7e4e7b15d8b68289b5324847f14 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb 8384d03147c8e5d3accd73c77a7524a4164b1ed9 xxd_8.2.2434-3+deb11u3+tuxcare.els3_armel.deb a277b7e403c9236a372c129d5eb51c56788b7836 CLSA-2026:1789289969 TuxCare License Agreement 0 * SECURITY UPDATE: wrong reuse of SMB connection - debian/patches/CVE-2026-5773.patch: disable connection reuse for SMB and SMBS by closing the connection in smb_connect() in lib/smb.c. - CVE-2026-5773 * SECURITY UPDATE: stale custom cookie host causes cookie leak - debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c. - CVE-2026-6276 * SECURITY UPDATE: wrong STARTTLS connection reuse - debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c. - CVE-2026-8286 * SECURITY UPDATE: env-set cross-proxy Digest auth state leak - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h. - CVE-2026-8927 * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache - debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c. - CVE-2026-8932 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: wrong reuse of SMB connection - debian/patches/CVE-2026-5773.patch: disable connection reuse for SMB and SMBS by closing the connection in smb_connect() in lib/smb.c. - CVE-2026-5773 * SECURITY UPDATE: stale custom cookie host causes cookie leak - debian/patches/CVE-2026-6276.patch: clear the remembered custom Host: name at the start of every request in lib/http.c. - CVE-2026-6276 * SECURITY UPDATE: wrong STARTTLS connection reuse - debian/patches/CVE-2026-8286.patch: require a matching SSL configuration when reusing a connection for a transfer that may upgrade to TLS in lib/url.c. - CVE-2026-8286 * SECURITY UPDATE: env-set cross-proxy Digest auth state leak - debian/patches/CVE-2026-8927.patch: flush the proxy Digest state when the proxy read from the environment changes in lib/url.c, lib/urldata.h. - CVE-2026-8927 * SECURITY UPDATE: incomplete mTLS config in connection reuse and TLS session cache - debian/patches/CVE-2026-8932.patch: include the client private key options in the primary SSL config so connection reuse and the TLS session cache compare them in lib/url.c, lib/urldata.h, lib/vtls/vtls.c. - CVE-2026-8932

0 tuxcare-debian11-els curl_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 45e4d9eea4020113560feada2398a27372b412b4 libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 991ebb2b2fb2a2e5ba6bf45147c3455ef4e7f574 libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 1d15195046643628971bea6c81156decbf597635 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 10ad08571e47cc71e2fbddd5f9dcd344f7c2b276 libcurl4-doc_7.74.0-1.3+deb11u16+tuxcare.els1_all.deb 968c1631fc4fcd8602b548e60cd01f504c096522 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 4184ae6985af12ffbae9034b9a6ba74c23991041 libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 34b4140029131f873a7472ba36ac04af5658d05f libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els1_amd64.deb 9fd259919562ba554794ed393e4685d04fd00d24 curl_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb ef47ab7b68c3ecea65cde873cbeb08496db48dbb libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb e62ff7dc0ceb502a56a01e057a6bd02ad3cda819 libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb 08f0daee42f7d7959b5e6697059453742d4814a4 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb fea7e44de51b854f2f61146a58a4c56ae396fea8 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb 04df41b9b2441bdd82961de53b0df64d641e62d0 libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb f235f09867741962248a69b0ebc08176f8db06a2 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els1_arm64.deb cd040a0246f54f56da2c281b76ba8f50cb07ccb7 curl_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb ca0af672a99e835351300cfc2874bbc3c950a5f7 libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb 20d12f08ef8f2de6078d9eb4327a96e0a3ff6e7d libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb 64a97522f07282408ce975046496cf260ac09f80 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb c78e1e20db11f479838b68226cc34647d1db0311 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb 83c95cca1a592e5400b06e13cf3f7d2c21d2f3bf libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb d003599d63f44d02af1ee801b914d5607ef57f58 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els1_armel.deb 970297f7c7c2d59b6fa27864d8d9bb949b28c140 CLSA-2026:1789290988 TuxCare License Agreement 0 * SECURITY UPDATE: ANSI escape sequence injection via the sideband channel, allowing a malicious remote to corrupt terminal state, hide information, or insert characters into the terminal input buffer during clone, fetch and push (CWE-150) - debian/patches/CVE-2024-52005.patch: add strbuf_add_sanitized() in sideband.c and route the two remote-controlled sideband writes through it, replacing control characters with the conventional ^<letter> notation (^[ for ESC, ^A for 0x01, ^? for DEL) while letting tab and newline through. Also carries upstream's t5409-colorize-remote-messages.sh regression test. - CVE-2024-52005 * debian/rules: skip the git-svn test suite on armel only. Subversion's directory I/O goes through APR, and Debian's armel libapr1 links the non-LFS readdir(), so dirent.d_ino is 32 bit there; when the source tree lives on a filesystem handing out inode numbers >= 2^32 every git-svn test aborts with "svn: E000075: Can't read directory ...: Value too large for defined data type". This is a limitation of the build environment, not a defect in git -- Debian's own armel buildd runs the same tests successfully. All other architectures continue to run the git-svn suite in full. Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: ANSI escape sequence injection via the sideband channel, allowing a malicious remote to corrupt terminal state, hide information, or insert characters into the terminal input buffer during clone, fetch and push (CWE-150) - debian/patches/CVE-2024-52005.patch: add strbuf_add_sanitized() in sideband.c and route the two remote-controlled sideband writes through it, replacing control characters with the conventional ^<letter> notation (^[ for ESC, ^A for 0x01, ^? for DEL) while letting tab and newline through. Also carries upstream's t5409-colorize-remote-messages.sh regression test. - CVE-2024-52005 * debian/rules: skip the git-svn test suite on armel only. Subversion's directory I/O goes through APR, and Debian's armel libapr1 links the non-LFS readdir(), so dirent.d_ino is 32 bit there; when the source tree lives on a filesystem handing out inode numbers >= 2^32 every git-svn test aborts with "svn: E000075: Can't read directory ...: Value too large for defined data type". This is a limitation of the build environment, not a defect in git -- Debian's own armel buildd runs the same tests successfully. All other architectures continue to run the git-svn suite in full.

0 tuxcare-debian11-els git_2.30.2-1+deb11u5+tuxcare.els1_amd64.deb e79218b1a4de33fb535d16f50a0db9ab8a2b01cc git-all_2.30.2-1+deb11u5+tuxcare.els1_all.deb 9f5a118221fd55b1b5a0cc82a90f0f2c13940289 git-cvs_2.30.2-1+deb11u5+tuxcare.els1_all.deb 64756ad7c0cc3bd7ccf3968fc50f327df44408d7 git-daemon-run_2.30.2-1+deb11u5+tuxcare.els1_all.deb ee5e47864af7b3831d1268b4956629680365c631 git-daemon-sysvinit_2.30.2-1+deb11u5+tuxcare.els1_all.deb c0c5bee5f2e4147c6e7275dfdf8e8872d72c7e86 git-doc_2.30.2-1+deb11u5+tuxcare.els1_all.deb 91e199b493fdd636171f21b8b9a42efa090b53eb git-el_2.30.2-1+deb11u5+tuxcare.els1_all.deb 4ca53493e793a23d2591970c9511eeeb3da63136 git-email_2.30.2-1+deb11u5+tuxcare.els1_all.deb a7010c4dd07d082b5cc0e3aea134729ea8fc0924 git-gui_2.30.2-1+deb11u5+tuxcare.els1_all.deb 487215510b342bf91dc14bbac58a4b43a4cd3ed2 git-man_2.30.2-1+deb11u5+tuxcare.els1_all.deb 240193b7dd2c60ab1453772647e11f35205c8eff git-mediawiki_2.30.2-1+deb11u5+tuxcare.els1_all.deb 45e1f0488cd50b0bdb0762eafa98db2dccc45831 git-svn_2.30.2-1+deb11u5+tuxcare.els1_all.deb bf7471926e86922c31b3daed2078d2e2561dfe65 gitk_2.30.2-1+deb11u5+tuxcare.els1_all.deb a4af0e7becb496ae491491548eddfba6c1d3a3d4 gitweb_2.30.2-1+deb11u5+tuxcare.els1_all.deb 0b9ba473fa978690e38716252b851d1ecd0c11ff git_2.30.2-1+deb11u5+tuxcare.els1_arm64.deb 37b845373e83b10e8c0005176574d2d8493c47e6 git_2.30.2-1+deb11u5+tuxcare.els1_armel.deb 6fbc63861c27fd1a31cc6a6cf7b5c3be7d1cd177 CLSA-2026:1789291176 TuxCare License Agreement 0 * SECURITY UPDATE: Integer overflow into heap buffer overflow when escaping a URI string - debian/patches/gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch: add this patch to debian/patches/series. The file already shipped in 2.66.8-1+deb11u7, and that upload's changelog announces the CVE as fixed, but the patch was never added to the series and so was never applied: it is the only orphan in the 97-entry quilt stack, while every other CVE patch from the same entry (CVE-2025-14087, CVE-2025-4373, CVE-2025-7039) is listed. The shipped library therefore still counts unacceptable characters in a gint in g_escape_uri_string() in glib/gconvert.c, so g_malloc() is called with p - string + unacceptable * 2 + 1 after the multiplication has wrapped to INT_MIN. Confirmed against the stock Debian 11 libglib2.0-0 2.66.8-1+deb11u8: g_filename_to_uri() on a path of 2^30 escapable characters aborts in gmem.c with "failed to allocate 18446744072635809794 bytes", i.e. the negative sum widened to gsize. The patch is the vendor's own file and is added verbatim, unmodified. - CVE-2025-13601 * SECURITY UPDATE: Off-by-one over-read in the GVariant tuple deserialiser - debian/patches/CVE-2026-58010.patch: correct the padding bounds test in gvs_tuple_is_normal() in glib/gvariant-serialiser.c from offset > value.size to offset >= value.size, which allowed a one-byte read past the end of the serialised data - CVE-2026-58010 * SECURITY UPDATE: Missing range validation in g_date_time_add_full() - debian/patches/CVE-2026-58011.patch: reject results outside 0001-01-01..9999-12-31 in glib/gdatetime.c instead of leaving the "XXX validate" placeholder, preventing a two-byte over-read when the computed day count falls outside the representable range - CVE-2026-58011 * SECURITY UPDATE: Buffer over-read in g_regex_replace() in raw mode - debian/patches/CVE-2026-58012.patch: handle case-changing substitutions byte-wise rather than as UTF-8 in glib/gregex.c when the pattern was compiled with G_REGEX_RAW, where the subject is not required to be valid UTF-8 - CVE-2026-58012 * SECURITY UPDATE: memcmp() past the end of the buffer in GIOChannel - debian/patches/CVE-2026-58013.patch: bound the line-terminator comparison in glib/giochannel.c by the remaining buffer length, which was over-read when a custom terminator is longer than the data left - CVE-2026-58013 * SECURITY UPDATE: One-byte heap under-read in GKeyFile - debian/patches/CVE-2026-58014.patch: guard the trailing-separator test in g_key_file_get_locale_string_list() in glib/gkeyfile.c with len > 0, which indexed value[-1] for an empty value - CVE-2026-58014 * SECURITY UPDATE: Path traversal via the D-Bus SHA-1 cookie context - debian/patches/CVE-2026-58015.patch: validate the server-supplied cookie context in gio/gdbusauthmechanismsha1.c against the D-Bus specification before using it as a keyring filename, so a malicious peer cannot direct the client to hash arbitrary files - CVE-2026-58015 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Integer overflow into heap buffer overflow when escaping a URI string - debian/patches/gconvert-Error-out-if-g_escape_uri_string-would-overflow.patch: add this patch to debian/patches/series. The file already shipped in 2.66.8-1+deb11u7, and that upload's changelog announces the CVE as fixed, but the patch was never added to the series and so was never applied: it is the only orphan in the 97-entry quilt stack, while every other CVE patch from the same entry (CVE-2025-14087, CVE-2025-4373, CVE-2025-7039) is listed. The shipped library therefore still counts unacceptable characters in a gint in g_escape_uri_string() in glib/gconvert.c, so g_malloc() is called with p - string + unacceptable * 2 + 1 after the multiplication has wrapped to INT_MIN. Confirmed against the stock Debian 11 libglib2.0-0 2.66.8-1+deb11u8: g_filename_to_uri() on a path of 2^30 escapable characters aborts in gmem.c with "failed to allocate 18446744072635809794 bytes", i.e. the negative sum widened to gsize. The patch is the vendor's own file and is added verbatim, unmodified. - CVE-2025-13601 * SECURITY UPDATE: Off-by-one over-read in the GVariant tuple deserialiser - debian/patches/CVE-2026-58010.patch: correct the padding bounds test in gvs_tuple_is_normal() in glib/gvariant-serialiser.c from offset > value.size to offset >= value.size, which allowed a one-byte read past the end of the serialised data - CVE-2026-58010 * SECURITY UPDATE: Missing range validation in g_date_time_add_full() - debian/patches/CVE-2026-58011.patch: reject results outside 0001-01-01..9999-12-31 in glib/gdatetime.c instead of leaving the "XXX validate" placeholder, preventing a two-byte over-read when the computed day count falls outside the representable range - CVE-2026-58011 * SECURITY UPDATE: Buffer over-read in g_regex_replace() in raw mode - debian/patches/CVE-2026-58012.patch: handle case-changing substitutions byte-wise rather than as UTF-8 in glib/gregex.c when the pattern was compiled with G_REGEX_RAW, where the subject is not required to be valid UTF-8 - CVE-2026-58012 * SECURITY UPDATE: memcmp() past the end of the buffer in GIOChannel - debian/patches/CVE-2026-58013.patch: bound the line-terminator comparison in glib/giochannel.c by the remaining buffer length, which was over-read when a custom terminator is longer than the data left - CVE-2026-58013 * SECURITY UPDATE: One-byte heap under-read in GKeyFile - debian/patches/CVE-2026-58014.patch: guard the trailing-separator test in g_key_file_get_locale_string_list() in glib/gkeyfile.c with len > 0, which indexed value[-1] for an empty value - CVE-2026-58014 * SECURITY UPDATE: Path traversal via the D-Bus SHA-1 cookie context - debian/patches/CVE-2026-58015.patch: validate the server-supplied cookie context in gio/gdbusauthmechanismsha1.c against the D-Bus specification before using it as a keyring filename, so a malicious peer cannot direct the client to hash arbitrary files - CVE-2026-58015

0 tuxcare-debian11-els libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els2_amd64.deb 55eaa53a1b68736417663c4c674c0b049f7d159d libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els2_amd64.deb 755a7bd0d3901d319e040282098c7dfa9f53dadc libglib2.0-data_2.66.8-1+deb11u8+tuxcare.els2_all.deb 644aa102258578a8fd0fee10e5c37e143f8f2efe libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els2_amd64.deb 04a21aa562daab849be32e70285000f9f5d58e4b libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els2_amd64.deb dba44a78aeb55a9143a789d3ecd83cabd79ce470 libglib2.0-doc_2.66.8-1+deb11u8+tuxcare.els2_all.deb 108d6a7839b5ffed8e2bba1b6d06781515babe4b libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els2_amd64.deb 360f040b157376c5137fe52bf632c212ab6e6b40 libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els2_arm64.deb b631be5719e70c36f0b35dadbba4e7812dcfc3c2 libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els2_arm64.deb 03a0ed94d0d9850180b6ae1d50bccebc3db21b84 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els2_arm64.deb 21b087495ecc7cae742ca9160cc7b5a6b95c019b libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els2_arm64.deb 4b796d0094d6a38ac63c7f85abc4926b66e0828e libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els2_arm64.deb 35a5ad4668a7bbd117acf5fb119d40fbdf3f42ec libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els2_armel.deb 9d36900c026c0056aa4f3cb87685cac479520965 libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els2_armel.deb 26ca3bbe291941b4de7f7d34dce264a6566a7fc8 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els2_armel.deb d4523cb90ce7cd2e9863307d4de57a7ae72bda9d libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els2_armel.deb ae0d61c374d29a44dcce11bab91bd3a4c605719f libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els2_armel.deb 436a8f8a1ce2ad101c935319487fad1fb235d9b5 CLSA-2026:1789291359 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer overflow via an integer overflow in the PE rebuilder - debian/patches/CVE-2026-20213.patch: sum rebuilt section sizes in a 64-bit temporary and reject packed section totals or allocations that exceed CLI_MAX_ALLOCATION in libclamav/rebuildpe.c. - CVE-2026-20213 * SECURITY UPDATE: out-of-bounds write via a section loop underflow in the FSG unpacker - debian/patches/CVE-2026-20214.patch: iterate the section loop with t < sectcnt instead of t <= sectcnt - 1, which underflows when sectcnt is zero, in libclamav/pe.c. - CVE-2026-20214 * SECURITY UPDATE: heap buffer overflow via a 7z substream count overflow - debian/patches/CVE-2026-20215.patch: reject archives whose total unpack-stream count would overflow UInt32 before it is accumulated in libclamav/7z/7zIn.c. - CVE-2026-20215 * SECURITY UPDATE: denial of service via unenforced extraction limits in the InstallShield parser - debian/patches/CVE-2026-20216.patch: apply cli_checklimits() to header parsing and to cab extraction output, and guard the output size accumulator against overflow, in libclamav/ishield.c. - CVE-2026-20216 * SECURITY UPDATE: invalid free via incorrect cleanup bitmap tracking in the PESpin unpacker - debian/patches/CVE-2026-20217.patch: shift the bitmap that the cleanup loop tests, not the unrelated bitman variable, in libclamav/spin.c. - CVE-2026-20217 * SECURITY UPDATE: denial of service via size handling errors in the ALZ parser - debian/patches/CVE-2026-20243.patch: harden ALZ size arithmetic, extract stored, bzip2 and deflate members under scan budgets, use bounded flate2 reads and drop the inflate dependency, in libclamav_rust/src/{alz,scanners,util,sys}.rs, libclamav_rust/Cargo.toml, libclamav_rust/build.rs, libclamav/libclamav.map and Cargo.lock. - CVE-2026-20243 * SECURITY UPDATE: out-of-bounds read via integer overflow in the DMG mish size checks on 32-bit platforms - debian/patches/CVE-2026-20244.patch: compute the expected mish block length in a 64-bit integer, keep the XML range check in subtraction form and avoid overflow in the base64 buffer size, in libclamav/dmg.c. - CVE-2026-20244 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer overflow via an integer overflow in the PE rebuilder - debian/patches/CVE-2026-20213.patch: sum rebuilt section sizes in a 64-bit temporary and reject packed section totals or allocations that exceed CLI_MAX_ALLOCATION in libclamav/rebuildpe.c. - CVE-2026-20213 * SECURITY UPDATE: out-of-bounds write via a section loop underflow in the FSG unpacker - debian/patches/CVE-2026-20214.patch: iterate the section loop with t < sectcnt instead of t <= sectcnt - 1, which underflows when sectcnt is zero, in libclamav/pe.c. - CVE-2026-20214 * SECURITY UPDATE: heap buffer overflow via a 7z substream count overflow - debian/patches/CVE-2026-20215.patch: reject archives whose total unpack-stream count would overflow UInt32 before it is accumulated in libclamav/7z/7zIn.c. - CVE-2026-20215 * SECURITY UPDATE: denial of service via unenforced extraction limits in the InstallShield parser - debian/patches/CVE-2026-20216.patch: apply cli_checklimits() to header parsing and to cab extraction output, and guard the output size accumulator against overflow, in libclamav/ishield.c. - CVE-2026-20216 * SECURITY UPDATE: invalid free via incorrect cleanup bitmap tracking in the PESpin unpacker - debian/patches/CVE-2026-20217.patch: shift the bitmap that the cleanup loop tests, not the unrelated bitman variable, in libclamav/spin.c. - CVE-2026-20217 * SECURITY UPDATE: denial of service via size handling errors in the ALZ parser - debian/patches/CVE-2026-20243.patch: harden ALZ size arithmetic, extract stored, bzip2 and deflate members under scan budgets, use bounded flate2 reads and drop the inflate dependency, in libclamav_rust/src/{alz,scanners,util,sys}.rs, libclamav_rust/Cargo.toml, libclamav_rust/build.rs, libclamav/libclamav.map and Cargo.lock. - CVE-2026-20243 * SECURITY UPDATE: out-of-bounds read via integer overflow in the DMG mish size checks on 32-bit platforms - debian/patches/CVE-2026-20244.patch: compute the expected mish block length in a 64-bit integer, keep the XML range check in subtraction form and avoid overflow in the base64 buffer size, in libclamav/dmg.c. - CVE-2026-20244

0 tuxcare-debian11-els clamav_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb 6252e8ab4d664ea1447447922007ceab3ec17563 clamav-base_1.4.3+dfsg-1~deb11u1+tuxcare.els1_all.deb 1e06ba6ccb536e8a339ba9c4d3d669e1c93757f5 clamav-daemon_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb 8bb76dbbea994564fc416d0edc3cc5c950486e1a clamav-doc_1.4.3+dfsg-1~deb11u1+tuxcare.els1_all.deb f589c41443726f36c0f9ac2e422d86a065e9fafa clamav-docs_1.4.3+dfsg-1~deb11u1+tuxcare.els1_all.deb ff92a48358560e7ae7663648307e4e1def8e998d clamav-freshclam_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb 31c83d75a69ac64d893245a0f2c80d4306754481 clamav-milter_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb eea84319207f3a99d63e5d2909985e1191255a94 clamav-testfiles_1.4.3+dfsg-1~deb11u1+tuxcare.els1_all.deb e5996f723b108ea278b22e313ed6c10cd5504b43 clamdscan_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb 4aeb41e6753fb40e25089d9407a7f7d0697c3562 libclamav-dev_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb d2cd099e34e3c20448a45c7d6fe51070d39e070d libclamav12_1.4.3+dfsg-1~deb11u1+tuxcare.els1_amd64.deb 9ea70edf987c16e44850b14ba674225d10b5a9a5 clamav_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb 43643ba06d224dee0deef5e840c1e1df4b9ba3b8 clamav-daemon_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb 9b5f11908264eeefb9d2b01ef5d37fb26778a9d3 clamav-freshclam_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb 6c30d08f2bcea80b20093e74d85797931dfec9df clamav-milter_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb fe90c46937db3a1e330e0909f24784b9abcca5fc clamdscan_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb 5c893039898dd4cc711df30a1c588557f269c7b0 libclamav-dev_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb 76433f52728d3a31d47a429ddfce105a94dd273a libclamav12_1.4.3+dfsg-1~deb11u1+tuxcare.els1_arm64.deb b779c378b36a91d26777414fc779bd3714faa02e CLSA-2026:1789374596 TuxCare License Agreement 0 * SECURITY UPDATE: use-after-free in the ssh client when a remote forwarding is added over the multiplexing socket - debian/patches/CVE-2026-73282.patch: register a heap-allocated index instead of a pointer into options.remote_forwards[] as the pending remote-forward confirmation context in ssh.c, and re-resolve the array element in ssh_confirm_remote_forward(). - CVE-2026-73282 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: use-after-free in the ssh client when a remote forwarding is added over the multiplexing socket - debian/patches/CVE-2026-73282.patch: register a heap-allocated index instead of a pointer into options.remote_forwards[] as the pending remote-forward confirmation context in ssh.c, and re-resolve the array element in ssh_confirm_remote_forward(). - CVE-2026-73282

0 tuxcare-debian11-els openssh-client_8.4p1-5+deb11u7+tuxcare.els2_amd64.deb 1df05219ed07205929ca813151487b754f99fbe8 openssh-server_8.4p1-5+deb11u7+tuxcare.els2_amd64.deb b5f1d08da3e21b52d5afed5771e1f6ee01296b36 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els2_amd64.deb c5a8072ef1146f07defbe034a86cb31c02ad2c99 openssh-tests_8.4p1-5+deb11u7+tuxcare.els2_amd64.deb 032e5433a18e1452c23b312398287ea96d5523a0 ssh_8.4p1-5+deb11u7+tuxcare.els2_all.deb f4620d5fff2e1011c0de67ee545a22fb4f957b06 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els2_amd64.deb 078d10a4efa5459809cdf95f4de1b99981ba73fb openssh-client_8.4p1-5+deb11u7+tuxcare.els2_arm64.deb 924fb3a9bebc97ada02ca0f9700e991ca84694f0 openssh-server_8.4p1-5+deb11u7+tuxcare.els2_arm64.deb 7b042dba944b797104c45a504a173bf260a44046 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els2_arm64.deb e4a76b3249713f925763940a28a592506a8a2e30 openssh-tests_8.4p1-5+deb11u7+tuxcare.els2_arm64.deb ee9f2af56e47de3e865ea55624a91f7dc4696819 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els2_arm64.deb b21c9ee348efef50dabc206126cc811ccada8c5b openssh-client_8.4p1-5+deb11u7+tuxcare.els2_armel.deb 02f895be7359de3e7b47664a5872885c81455f55 openssh-server_8.4p1-5+deb11u7+tuxcare.els2_armel.deb b37a92f16630300ecc14dce34e1429c1d7f18a80 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els2_armel.deb 2cf5e5ad0c360b4c1f0fce93d2a60d3e2b9a3e1e openssh-tests_8.4p1-5+deb11u7+tuxcare.els2_armel.deb bd6b4b1f7547f6e094ae5215d970c9b8abc84770 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els2_armel.deb 29432fb3f6f4f87614b9ef4657727ccab9aa897d CLSA-2026:1789375226 TuxCare License Agreement 0 * SECURITY UPDATE: Remove the unmaintained ntlm_smb_lm_auth NTLM helper - debian/patches/CVE-2025-21311.patch: drop src/auth/ntlm/SMB_LM and its build wiring from configure.ac, configure, src/auth/ntlm/Makefile.am, src/auth/ntlm/Makefile.in and src/auth/ntlm/helpers.m4 - debian/rules: drop SMB_LM from --enable-auth-ntlm, so /usr/lib/squid/ntlm_smb_lm_auth is no longer built or shipped and NTLM authentication must use an externally provided helper such as Samba ntlm_auth - CVE-2025-21311 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Remove the unmaintained ntlm_smb_lm_auth NTLM helper - debian/patches/CVE-2025-21311.patch: drop src/auth/ntlm/SMB_LM and its build wiring from configure.ac, configure, src/auth/ntlm/Makefile.am, src/auth/ntlm/Makefile.in and src/auth/ntlm/helpers.m4 - debian/rules: drop SMB_LM from --enable-auth-ntlm, so /usr/lib/squid/ntlm_smb_lm_auth is no longer built or shipped and NTLM authentication must use an externally provided helper such as Samba ntlm_auth - CVE-2025-21311

0 tuxcare-debian11-els squid_4.13-10+deb11u7+tuxcare.els2_amd64.deb ba6898798a97b76a51709c645ff7b68b6c3b0e74 squid-cgi_4.13-10+deb11u7+tuxcare.els2_amd64.deb 2824de5e5cbdf206cab0fe96ab95cb724bad08b7 squid-common_4.13-10+deb11u7+tuxcare.els2_all.deb a45ba6527c550f5a5e90fe0eb1d271f819eb8ad3 squid-openssl_4.13-10+deb11u7+tuxcare.els2_amd64.deb 529c40fedd4ebb002f6e259b0d0519fd3d8696e6 squid-purge_4.13-10+deb11u7+tuxcare.els2_amd64.deb 10a59a7d05f8df66e1683ae9668f647b6a5d118b squidclient_4.13-10+deb11u7+tuxcare.els2_amd64.deb 6e4792fe899f64f88ab46462c3dad5f6ffad273f squid_4.13-10+deb11u7+tuxcare.els2_arm64.deb f6b6969a1593639957a62159d311a122d5b25c32 squid-cgi_4.13-10+deb11u7+tuxcare.els2_arm64.deb 79939555dbf8f7619deb94a15989355a87d9169c squid-openssl_4.13-10+deb11u7+tuxcare.els2_arm64.deb c4a285c7c15bfbe1c7065358f20130218a1a35ca squid-purge_4.13-10+deb11u7+tuxcare.els2_arm64.deb 8ca4b3ba3541b0430faeb15b877a2df829a052f1 squidclient_4.13-10+deb11u7+tuxcare.els2_arm64.deb d736466a67948bf697a108795bb41488bc8c37a8 squid_4.13-10+deb11u7+tuxcare.els2_armel.deb 8501423db87bb3dba4bffdbbf49605b103271467 squid-cgi_4.13-10+deb11u7+tuxcare.els2_armel.deb 2578b9b168100e29d08e68bdd281f39fbe7b7bf0 squid-openssl_4.13-10+deb11u7+tuxcare.els2_armel.deb 0ebc9c1c926f93282a69bd46d698359f061a5070 squid-purge_4.13-10+deb11u7+tuxcare.els2_armel.deb 522d772292c563c46881dfc393a34d29b7334980 squidclient_4.13-10+deb11u7+tuxcare.els2_armel.deb 3829492cff0cf081fab1b695506137085daf1e82 CLSA-2026:1789375441 TuxCare License Agreement 0 * SECURITY UPDATE: Out of bounds access and DoS in CTDB protocol handling - debian/patches/CVE-2026-58224.patch: validate protocol field lengths, bound array allocations and secure the sock_daemon socket - CVE-2026-58224 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out of bounds access and DoS in CTDB protocol handling - debian/patches/CVE-2026-58224.patch: validate protocol field lengths, bound array allocations and secure the sock_daemon socket - CVE-2026-58224

0 tuxcare-debian11-els ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 98af45eff47ec583a137f8b24dc1ece3e5ed3316 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 9a06b69b3ca642450b2a1b3ccc43f00230453ec9 libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 4652ecdb59ac485eca2211f1c634b85bf8f06dff libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 3b16f8cdcdbf3efe4daf30e7b70ff084236fcf8a libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb f36c5fd9306a9d54730df3d56560565937403d64 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb e11e61d168aab30fbca9fd207cf70cdd6cf2bf42 libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb faf45e30360f4ec05e93c68c500add67ad078977 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 61b60b0e921beb355e82c670668675abc778f8fb registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb b0a8e3a0ab2889fd1bc8989e3efd1c2cfa2b9616 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb b5feda8e46983858e1bdbe680467b946726c6a71 samba-common_4.13.13+dfsg-1~deb11u8+tuxcare.els2_all.deb f05c0ab32c22d261afc8a78c0e6056ef789e9a41 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 1d2f8485834a3d2c60086c4b1745758e7af9b6a0 samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb d4e3dcc3a30a9e220836bd7978305cdaaa6cd550 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 128274883bc6d8099a22f4b1d03c06300199447f samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 1eda85da306b4d1e79323e21e48f5401490025ee samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 5bbe48ebbbf5da4b000889fd6fa7636d215257d5 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 203e290179170990fc9f1c634caf497823c4fc76 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 2f1e5109754f4a3e989ccd1304f1771052f90d97 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_amd64.deb 43b5c914c03ca98d1c025aacbbcd901b5e703259 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb a022149a7dca9a300532c70ee1c7cef76e5df05a libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb f8d61023ee4d7fa65831bb9aa4778522d2b9adc7 libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 3f3d8a359dc9512824341f4f056ec488c68fc126 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 2e54f9a877a915a0bf47660cab6185a354854b05 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 2e00171fced80682e7b98e18609ec59d34ebde7c libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 255e26123bc8fbc7bd5fa1fcdc0cba93b3a751db libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 395ea463d3aef769950d72f6a9ba048d88a13884 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 65a504147ba55cae482ebc00877256d72f355c61 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb eb3ebcff9e00f04b73f6018474b20f203e7498c1 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb e18af1737ea4b881984c61e79a9bffa75876c3b7 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 05a61d88b6cedd75cac23b92b1eb6f646154ef7d samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb bc021576501e63e06f7f8a0cc6e1cd11476687d3 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 8489df9f4739a252c703bb4ca81abd80c9fe662d samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 084f4ee974c5bb03bfed71f662b0051e17390dbb samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 0684dbb85c47b561c42ed6786495c05097935340 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 48eb74a5ad0e76e493fcb65124fba4120e8348ec smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 1408a672c144a8c16c5d56f5b668a15c87ba7f3b winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_arm64.deb 3c7676c82ee0738deae1a35988f28491500d8a7f ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb a2d10fa7b581ce92c849537d4b53f99b5986192e libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb f4c347c6b274cf56a328a29de6a3aee8d8e15189 libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb bb07e7fcf842f768b206f6535713210df545b03e libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 212288bd9c609c78a758b56e64c219ad476f7e60 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 545c89a1f53c1734da228790bc07fc9137681a4c libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 7f2af7300d01e0aeb16aed7a5e8ebe596ead3eed libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 6ce5e0a7d67209b9c79ecea07ac581f0a08e0d66 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 6bec25184d6aad6ba159ad4b484797546581c071 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 722c8eb5ead83e873aad2843abb3dd90995cadd2 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 36702590bd6fe0bba2eb5f125219214765625448 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 3644a6fb857684b6e44e650d4fa4dddf6ba9a8c8 samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb d39c05681af4957f47d76fc82bc0416e889a0923 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 72f6da812bd9ddeb860e0aa445596e85ecf417f3 samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 5cc1f9e5fc989c20d6fa2770bc66d355132c3d58 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 6185dc3afe6bfa5ab4e338007ec1cea89176ebb5 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 625dd456fd915e9bbb9c0eea809d3f19fda1e9c1 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb d507aa2f9b10bc177ecec5c5f773e890e8701fa5 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els2_armel.deb 936c89025a7161c424a6361681b1b4b3454f8552 CLSA-2026:1789375664 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read in parameter transformation - debian/patches/CVE-2022-3715.patch: reject an empty transformation operator in parameter_brace_transform before valid_parameter_transform reads past the end of the operator string in subst.c - CVE-2022-3715 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read in parameter transformation - debian/patches/CVE-2022-3715.patch: reject an empty transformation operator in parameter_brace_transform before valid_parameter_transform reads past the end of the operator string in subst.c - CVE-2022-3715

0 tuxcare-debian11-els bash_5.1-2+deb11u1+tuxcare.els1_amd64.deb 84e6fb8b3792210787605e018f310616b0f507bb bash-builtins_5.1-2+deb11u1+tuxcare.els1_amd64.deb cd8516f9bad705a3ffda496586f62adb607f2d61 bash-doc_5.1-2+deb11u1+tuxcare.els1_all.deb 11e81c3b7aa8dc18114c482255a6e311d7329631 bash-static_5.1-2+deb11u1+tuxcare.els1_amd64.deb 8b77e7eef10f426028fc78c6af135a7baf8a76c3 bash_5.1-2+deb11u1+tuxcare.els1_arm64.deb f55bd9b7faf70a1f32382524d305e71eeab0f361 bash-builtins_5.1-2+deb11u1+tuxcare.els1_arm64.deb 95d91e2aeec7dc943b5a5ea7749e7a3a163ed30f bash-static_5.1-2+deb11u1+tuxcare.els1_arm64.deb dbc8264b57adb5517d1b507a0c66560e69ef7f38 bash_5.1-2+deb11u1+tuxcare.els1_armel.deb 84a02f3920e3a17db123940a22ae929c25e8f437 bash-builtins_5.1-2+deb11u1+tuxcare.els1_armel.deb 85c4dccddc622a37b8d2a6cdc6fcd40f5d43cfa8 bash-static_5.1-2+deb11u1+tuxcare.els1_armel.deb 7849bc11e7ab33d9831b2859086890d717664dcc CLSA-2026:1789375817 TuxCare License Agreement 0 * SECURITY UPDATE: Heap buffer overflow in the unzip test command builder - debian/patches/CVE-2018-13410.patch: allocate one more byte for the command string built in check_zipfile() in zip.c, so that the quotes, separator and terminating NUL added around the archive name when -TT is used cannot write past the end of the buffer - CVE-2018-13410 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap buffer overflow in the unzip test command builder - debian/patches/CVE-2018-13410.patch: allocate one more byte for the command string built in check_zipfile() in zip.c, so that the quotes, separator and terminating NUL added around the archive name when -TT is used cannot write past the end of the buffer - CVE-2018-13410

0 tuxcare-debian11-els zip_3.0-12+tuxcare.els1_amd64.deb ccd79075dfc88b6394703476460a8df3fea37e5a zip_3.0-12+tuxcare.els1_arm64.deb 432da1d7d4c7f5d06d5548894fbd78266d6b5a8e zip_3.0-12+tuxcare.els1_armel.deb da1e97d055539669e8868d9e5fdcfeaebbdc245c CLSA-2026:1789042546 TuxCare License Agreement 0 * SECURITY UPDATE: Possible remote code execution during DNSSEC validation - debian/patches/CVE-2026-33278.patch: Possible remote code execution during DNSSEC validation - CVE-2026-33278 * SECURITY UPDATE: Ghost domain name variant - debian/patches/CVE-2026-40622.patch: Ghost domain name variant - CVE-2026-40622 * SECURITY UPDATE: Parsing a long list of incoming EDNS options degrades performance - debian/patches/CVE-2026-41292.patch: Parsing a long list of incoming EDNS options degrades performance - CVE-2026-41292 * SECURITY UPDATE: Crash during DNSSEC validation of malicious content - debian/patches/CVE-2026-42959.patch: Crash during DNSSEC validation of malicious content - CVE-2026-42959 * SECURITY UPDATE: Possible cache poisoning attack while following delegation - debian/patches/CVE-2026-42960.patch: Possible cache poisoning attack while following delegation - CVE-2026-42960 * SECURITY UPDATE: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined - debian/patches/CVE-2026-56444.patch: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined - CVE-2026-56444 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Possible remote code execution during DNSSEC validation - debian/patches/CVE-2026-33278.patch: Possible remote code execution during DNSSEC validation - CVE-2026-33278 * SECURITY UPDATE: Ghost domain name variant - debian/patches/CVE-2026-40622.patch: Ghost domain name variant - CVE-2026-40622 * SECURITY UPDATE: Parsing a long list of incoming EDNS options degrades performance - debian/patches/CVE-2026-41292.patch: Parsing a long list of incoming EDNS options degrades performance - CVE-2026-41292 * SECURITY UPDATE: Crash during DNSSEC validation of malicious content - debian/patches/CVE-2026-42959.patch: Crash during DNSSEC validation of malicious content - CVE-2026-42959 * SECURITY UPDATE: Possible cache poisoning attack while following delegation - debian/patches/CVE-2026-42960.patch: Possible cache poisoning attack while following delegation - CVE-2026-42960 * SECURITY UPDATE: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined - debian/patches/CVE-2026-56444.patch: Degradation of resolution service when discard-timeout and serve-expired-client-timeout are combined - CVE-2026-56444

0 tuxcare-debian11-els libunbound-dev_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb 5aa7d04529da99c9e8101b9f315d788b78ab632a libunbound8_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb 5a515213ff234653dcc82bf7e0ed6336a1923a4b python3-unbound_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb c424b57d995943894fbdd078deaaa5e32764aec7 unbound_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb c3e6c0ddefd48a92b7623b97e15563f1a861a4c9 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb 9d8a9a0fde07412496d851118d929d22846b3cc3 unbound-host_1.13.1-1+deb11u7+tuxcare.els2_amd64.deb 60cdad1311481bdbc4f6532a42c1774408f013ee libunbound-dev_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 999b0e92e2e778898e31b1cc1a153494b1e6d759 libunbound8_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 755a89303c0d973265bd9c50efde85a49a14aabc python3-unbound_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 1d232f60644b41d9e749caac75bd9a58ae8b7c15 unbound_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 0f1e9a358b19f88e42f55bffa520db4f4f94d73e unbound-anchor_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 5ab90602b7213fcf605da8a321c0edf1f6fb1a28 unbound-host_1.13.1-1+deb11u7+tuxcare.els2_arm64.deb 94385a175660ce9e3fdbd3d969f2a40cead916e1 libunbound-dev_1.13.1-1+deb11u7+tuxcare.els2_armel.deb 26bf4c4891e0ddb78db4e42718be8683b873de97 libunbound8_1.13.1-1+deb11u7+tuxcare.els2_armel.deb 0f7ba54c644a5448c1e58b271a373b89124dc667 python3-unbound_1.13.1-1+deb11u7+tuxcare.els2_armel.deb 2c5ae5e299c980bd88201d997f90cae889f5d51a unbound_1.13.1-1+deb11u7+tuxcare.els2_armel.deb 37a3e81d0e0bf3fda0b528881c71c4269715c89d unbound-anchor_1.13.1-1+deb11u7+tuxcare.els2_armel.deb 211f412f8deba05eafdc31b69589a6ad35dc6723 unbound-host_1.13.1-1+deb11u7+tuxcare.els2_armel.deb fc8601aa50979975851d2f31a06f3db391b4d6bf CLSA-2026:1789388743 TuxCare License Agreement 0 * SECURITY UPDATE: Use-after-free in TLS pending-data processing - debian/patches/CVE-2026-81934.patch: drain the TLS pending list from its head and detach each node before running its event handler in src/tls.c, so a handler that closes another pending connection cannot leave the iterator holding a freed node - CVE-2026-81934 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Use-after-free in TLS pending-data processing - debian/patches/CVE-2026-81934.patch: drain the TLS pending list from its head and detach each node before running its event handler in src/tls.c, so a handler that closes another pending connection cannot leave the iterator holding a freed node - CVE-2026-81934

0 tuxcare-debian11-els redis_6.0.16-1+deb11u9+tuxcare.els2_all.deb 778d8d6df3c93aa017707bde7e5be584b14a4a18 redis-sentinel_6.0.16-1+deb11u9+tuxcare.els2_amd64.deb 6cc56a29317eada94d7f29dcc7dbce5ea0596d45 redis-server_6.0.16-1+deb11u9+tuxcare.els2_amd64.deb 56f3edd60e2cfc922e508da8c50401d60f9c7ae8 redis-tools_6.0.16-1+deb11u9+tuxcare.els2_amd64.deb 32488b92d8dced8537d9fa199a8115eedfca2550 redis-sentinel_6.0.16-1+deb11u9+tuxcare.els2_arm64.deb 718af1443db903c1dcc9d4017d081930e51210fb redis-server_6.0.16-1+deb11u9+tuxcare.els2_arm64.deb 381647e3c2495a91ea70ed619abef8786dc79ef2 redis-tools_6.0.16-1+deb11u9+tuxcare.els2_arm64.deb 3a4b6c3698cc855f2c5b34787cbecbb57ee431a0 redis-sentinel_6.0.16-1+deb11u9+tuxcare.els2_armel.deb fbf254742401fef043171037712220033909c471 redis-server_6.0.16-1+deb11u9+tuxcare.els2_armel.deb a402f0fee74c7e4dfa134c6f64a4972941ea4cc4 redis-tools_6.0.16-1+deb11u9+tuxcare.els2_armel.deb fe43b694b0e6682cd0e4115efce217f40d000f11 CLSA-2026:1789390312 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read via a positional field width or precision in printf/sprintf - debian/patches/CVE-2023-4156.patch: reject a negative positional index in format_tree() in builtin.c. The digit run of a `%*N$' specifier is accumulated into an int, so a sufficiently long N wraps it negative; the existing guard tested only val >= num_args, letting the negative value reach the_args[val] and read before the start of the argument array - CVE-2023-4156 * SECURITY UPDATE: use-after-free in getline from a two-way pipe - debian/patches/CVE-2026-40467.patch: stop do_getline_redir() in io.c from releasing redir_exp immediately after redirect(), since the two-way-pipe error path still reads redir_exp->stptr/stlen through is_non_fatal_redirect(). The DEREF is moved to each control-flow path after the node's last use - CVE-2026-40467 * SECURITY UPDATE: heap buffer overflow in sub()/gsub() on 32-bit architectures - debian/patches/CVE-2026-40468.patch: widen the sofar accumulator in do_sub() in builtin.c from int to size_t so the running offset into the replacement buffer cannot overflow while the buffer itself is sized with size_t arithmetic. The upstream commit's second hunk, widening i to int64_t in parse_escape() in node.c, is carried verbatim for fidelity; it is inert here, as that function's octal and hex loops are bounded at 0777 and 0xFF and it returns int - CVE-2026-40468 * SECURITY UPDATE: integer overflow in the sub()/gsub() replacement size computation on 32-bit architectures - debian/patches/CVE-2026-40469.patch: compute the ampersand expansion in do_sub() in builtin.c as a uint64_t and fatal out with "replacement expansion too large" when the result would exceed SIZE_MAX, instead of wrapping and under-allocating the destination buffer - CVE-2026-40469 * SECURITY UPDATE: stack buffer overflow in the readdir extension - debian/patches/CVE-2026-40553.patch: build the path in ftype() in extension/readdir.c with a bounded snprintf() and reject the entry when the result would be truncated, replacing the unbounded strcpy()/strcat() pair that overflowed fname[] for a sufficiently long directory or entry name - CVE-2026-40553 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read via a positional field width or precision in printf/sprintf - debian/patches/CVE-2023-4156.patch: reject a negative positional index in format_tree() in builtin.c. The digit run of a `%*N$' specifier is accumulated into an int, so a sufficiently long N wraps it negative; the existing guard tested only val >= num_args, letting the negative value reach the_args[val] and read before the start of the argument array - CVE-2023-4156 * SECURITY UPDATE: use-after-free in getline from a two-way pipe - debian/patches/CVE-2026-40467.patch: stop do_getline_redir() in io.c from releasing redir_exp immediately after redirect(), since the two-way-pipe error path still reads redir_exp->stptr/stlen through is_non_fatal_redirect(). The DEREF is moved to each control-flow path after the node's last use - CVE-2026-40467 * SECURITY UPDATE: heap buffer overflow in sub()/gsub() on 32-bit architectures - debian/patches/CVE-2026-40468.patch: widen the sofar accumulator in do_sub() in builtin.c from int to size_t so the running offset into the replacement buffer cannot overflow while the buffer itself is sized with size_t arithmetic. The upstream commit's second hunk, widening i to int64_t in parse_escape() in node.c, is carried verbatim for fidelity; it is inert here, as that function's octal and hex loops are bounded at 0777 and 0xFF and it returns int - CVE-2026-40468 * SECURITY UPDATE: integer overflow in the sub()/gsub() replacement size computation on 32-bit architectures - debian/patches/CVE-2026-40469.patch: compute the ampersand expansion in do_sub() in builtin.c as a uint64_t and fatal out with "replacement expansion too large" when the result would exceed SIZE_MAX, instead of wrapping and under-allocating the destination buffer - CVE-2026-40469 * SECURITY UPDATE: stack buffer overflow in the readdir extension - debian/patches/CVE-2026-40553.patch: build the path in ftype() in extension/readdir.c with a bounded snprintf() and reject the entry when the result would be truncated, replacing the unbounded strcpy()/strcat() pair that overflowed fname[] for a sufficiently long directory or entry name - CVE-2026-40553

0 tuxcare-debian11-els gawk_5.1.0-1+tuxcare.els1_amd64.deb 30b89348566d53e2e07aa050e6c7afcb528540b7 gawk_5.1.0-1+tuxcare.els1_arm64.deb 8df322495deee3f02f63e7e28b5b8e858e81fd0a gawk_5.1.0-1+tuxcare.els1_armel.deb b37de411d7a073f04bdde795317dfc33f39a913f CLSA-2026:1789391878 TuxCare License Agreement 0 * Non-maintainer upload by the TuxCare ELS team. * CVE-2026-40261: Prevent a command injection vulnerability in Perforce::syncCodeBase(), which appended the source reference to the 'p4 sync -f' command without escaping. Package metadata served by a malicious or compromised Composer repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. - debian/patches/0019-CVE-2026-40261.patch * CVE-2026-40176: Prevent a command injection vulnerability in Perforce::generateP4Command(), which interpolated the Perforce connection parameters (user, client, port) into the 'p4' command line without escaping. A malicious composer.json declaring a Perforce VCS repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. Also backport the prerequisite upstream fix for Perforce::connectClient(), which passed the client spec path through the shell redirection of the same command line with only spaces escaped. - debian/patches/0020-CVE-2026-40176.patch * CVE-2023-43655: Refuse to run on a non-CLI SAPI when register_argc_argv is enabled and the entry point is a phar, which allowed a composer.phar published to a web-accessible directory to be driven through the query string. This package installs bin/composer as a plain PHP script and ships no phar, so the guard is inert here; it is applied for parity with the upstream and Debian bookworm fixes. - debian/patches/0021-CVE-2023-43655.patch Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Non-maintainer upload by the TuxCare ELS team. * CVE-2026-40261: Prevent a command injection vulnerability in Perforce::syncCodeBase(), which appended the source reference to the 'p4 sync -f' command without escaping. Package metadata served by a malicious or compromised Composer repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. - debian/patches/0019-CVE-2026-40261.patch * CVE-2026-40176: Prevent a command injection vulnerability in Perforce::generateP4Command(), which interpolated the Perforce connection parameters (user, client, port) into the 'p4' command line without escaping. A malicious composer.json declaring a Perforce VCS repository could inject shell metacharacters, leading to command execution even when Perforce is not installed. Also backport the prerequisite upstream fix for Perforce::connectClient(), which passed the client spec path through the shell redirection of the same command line with only spaces escaped. - debian/patches/0020-CVE-2026-40176.patch * CVE-2023-43655: Refuse to run on a non-CLI SAPI when register_argc_argv is enabled and the entry point is a phar, which allowed a composer.phar published to a web-accessible directory to be driven through the query string. This package installs bin/composer as a plain PHP script and ships no phar, so the guard is inert here; it is applied for parity with the upstream and Debian bookworm fixes. - debian/patches/0021-CVE-2023-43655.patch

0 tuxcare-debian11-els composer_2.0.9-2+deb11u4+tuxcare.els1_all.deb 4a210dfb1f0fe682f5109a2aa8eb02c6080ad963 CLSA-2026:1789392206 TuxCare License Agreement 0 * SECURITY UPDATE: Heap buffer overflow in remote filename charset conversion - debian/patches/CVE-2026-58471.patch: fix the E2BIG buffer-growth path of convert_fname() in src/url.c. On each iconv() overflow it recomputed the buffer size from the ORIGINAL length (done = len; len = done + inlen * 2) while resetting the write pointer to converted_fname + done, so outlen described a window that started before the bytes iconv() had already written; a multi-pass conversion therefore wrote past the allocation. The fix derives both the write offset and the remaining space from the actual bytes consumed (used = s - converted_fname) and guarantees the realloc grows the buffer - CVE-2026-58471 * SECURITY UPDATE: Integer overflow leading to heap buffer overflow in HTML attribute entity encoding - debian/patches/CVE-2026-58472.patch: change the size accumulator of html_quote_string() in src/convert.c from int to size_t and guard every addition with INT_ADD_OK(). The per-character increments were correct, but a sufficiently long input overflowed the signed int counter, so xmalloc() received an undersized (or negative) size and the second loop wrote the escaped string past the end of it - CVE-2026-58472 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap buffer overflow in remote filename charset conversion - debian/patches/CVE-2026-58471.patch: fix the E2BIG buffer-growth path of convert_fname() in src/url.c. On each iconv() overflow it recomputed the buffer size from the ORIGINAL length (done = len; len = done + inlen * 2) while resetting the write pointer to converted_fname + done, so outlen described a window that started before the bytes iconv() had already written; a multi-pass conversion therefore wrote past the allocation. The fix derives both the write offset and the remaining space from the actual bytes consumed (used = s - converted_fname) and guarantees the realloc grows the buffer - CVE-2026-58471 * SECURITY UPDATE: Integer overflow leading to heap buffer overflow in HTML attribute entity encoding - debian/patches/CVE-2026-58472.patch: change the size accumulator of html_quote_string() in src/convert.c from int to size_t and guard every addition with INT_ADD_OK(). The per-character increments were correct, but a sufficiently long input overflowed the signed int counter, so xmalloc() received an undersized (or negative) size and the second loop wrote the escaped string past the end of it - CVE-2026-58472

0 tuxcare-debian11-els wget_1.21-1+deb11u2+tuxcare.els1_amd64.deb d24b1f0ed4aacb4511a20b49f7fa3466709d631c wget_1.21-1+deb11u2+tuxcare.els1_arm64.deb aef2437cdb4092cfa0cc6c252d706823eba8af43 wget_1.21-1+deb11u2+tuxcare.els1_armel.deb e62f4994307ead463b1005888aaa0dddb611f56b CLSA-2026:1789394882 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds read and resultant infinite loop because low surrogates were treated the same as high surrogates in the *_toUtf16 functions (libexpat before 2.8.3) - debian/patches/CVE-2026-72522.patch: mask the high byte of the trailing code unit with 0xFC instead of 0xF8 in the DEFINE_UTF16_TO_UTF16(E) macro in expat/lib/xmltok.c, so the guard that avoids splitting a surrogate pair across two conversion calls matches only genuine high surrogates (0xD800-0xDBFF) and no longer accepts low surrogates (0xDC00-0xDFFF). On a buffer ending in a lone low surrogate the old test reported XML_CONVERT_INPUT_INCOMPLETE without consuming any input, so the caller retried while reading two bytes past the intended limit. One edit covers both little2_toUtf16 and big2_toUtf16. Reachable in the libexpatw (-DXML_UNICODE) build, which is where xmlparse.c maps XmlConvert to XmlUtf16Convert. - CVE-2026-72522 * SECURITY UPDATE: Use-after-free because handler call depth tracking was missing for custom encoding callbacks (libexpat before 2.8.4) - debian/patches/CVE-2026-76957.patch: route the application's unknown-encoding convert and release callbacks through the new callUnknownEncodingConvert() and callUnknownEncodingRelease() wrappers in expat/lib/xmlparse.c, storing the application callback in the new m_unknownEncodingConvert member and passing the parser itself as the encoding's user data. handleUnknownEncoding previously handed both callbacks out unwrapped, so m_handlerCallDepth stayed at zero while they ran and the reentrancy guard that rejects XML_ParserFree, XML_GetBuffer and XML_ResumeParser from inside a handler did not fire for them. - CVE-2026-76957 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds read and resultant infinite loop because low surrogates were treated the same as high surrogates in the *_toUtf16 functions (libexpat before 2.8.3) - debian/patches/CVE-2026-72522.patch: mask the high byte of the trailing code unit with 0xFC instead of 0xF8 in the DEFINE_UTF16_TO_UTF16(E) macro in expat/lib/xmltok.c, so the guard that avoids splitting a surrogate pair across two conversion calls matches only genuine high surrogates (0xD800-0xDBFF) and no longer accepts low surrogates (0xDC00-0xDFFF). On a buffer ending in a lone low surrogate the old test reported XML_CONVERT_INPUT_INCOMPLETE without consuming any input, so the caller retried while reading two bytes past the intended limit. One edit covers both little2_toUtf16 and big2_toUtf16. Reachable in the libexpatw (-DXML_UNICODE) build, which is where xmlparse.c maps XmlConvert to XmlUtf16Convert. - CVE-2026-72522 * SECURITY UPDATE: Use-after-free because handler call depth tracking was missing for custom encoding callbacks (libexpat before 2.8.4) - debian/patches/CVE-2026-76957.patch: route the application's unknown-encoding convert and release callbacks through the new callUnknownEncodingConvert() and callUnknownEncodingRelease() wrappers in expat/lib/xmlparse.c, storing the application callback in the new m_unknownEncodingConvert member and passing the parser itself as the encoding's user data. handleUnknownEncoding previously handed both callbacks out unwrapped, so m_handlerCallDepth stayed at zero while they ran and the reentrancy guard that rejects XML_ParserFree, XML_GetBuffer and XML_ResumeParser from inside a handler did not fire for them. - CVE-2026-76957

0 tuxcare-debian11-els expat_2.2.10-2+deb11u7+tuxcare.els2_amd64.deb d6c640981ea23623db899ff3cf51007fac8d4692 libexpat1_2.2.10-2+deb11u7+tuxcare.els2_amd64.deb 847a9e53799d9b9fb7153d87f09b2a38d00e468e libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els2_amd64.deb 8cca60084c84cb2172b45a4387adcc8e0ac4873d expat_2.2.10-2+deb11u7+tuxcare.els2_arm64.deb f342603d9281ea003d0f9fa59a0500a3d9124549 libexpat1_2.2.10-2+deb11u7+tuxcare.els2_arm64.deb e189f34d35fb5d6a7f1e00b03556fa94783e161a libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els2_arm64.deb 1b86666921d12e4c27a525851e48861fa55874a2 expat_2.2.10-2+deb11u7+tuxcare.els2_armel.deb 795e81b86305bba4b36f23a669fb1909a306c488 libexpat1_2.2.10-2+deb11u7+tuxcare.els2_armel.deb 8de8d055645c5b0cc17d35e964aa68b7bb4a3618 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els2_armel.deb 3e96c121f35d33b32173574ff06797644caf2ab4 CLSA-2026:1789398674 TuxCare License Agreement 0 * SECURITY UPDATE: stack-based buffer overflow in infocmp - debian/patches/CVE-2025-69720.patch: add a bounds check on strlen(cp) in analyze_string() in progs/infocmp.c and grow buf2 by one byte so a maliciously long SGR parameter list can no longer overflow the stack buffer. - CVE-2025-69720 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: stack-based buffer overflow in infocmp - debian/patches/CVE-2025-69720.patch: add a bounds check on strlen(cp) in analyze_string() in progs/infocmp.c and grow buf2 by one byte so a maliciously long SGR parameter list can no longer overflow the stack buffer. - CVE-2025-69720

0 tuxcare-debian11-els lib32ncurses-dev_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 449bae476cacc8b30d919eac21d207638bcb1587 lib32ncurses6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 9f8f5b8dff8202eb51690bfca94bf8e9e0e67723 lib32ncursesw6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb bc67fc7b4edb717a27cc7054e2d9af9673b81f45 lib32tinfo6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 412a37591215e97b1fb4e5d6a7de15a81398194f libncurses-dev_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 4512c1f9ef0b97260b96efad94453da813e58a65 libncurses5_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 490b734fc1641c0db9d959412ecf300a82cc5291 libncurses5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 243e1f6a45795b05ee49bdd520c99161d9ef5db8 libncurses6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb b0f423292cc90699974428dcaabc7e78a3545b3a libncursesw5_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 20fa79fa15f353adcc3e9be9d7b8b6456521cd83 libncursesw5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 246ff8d50f77c876a547897913d3d29118272688 libncursesw6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 928af9877494df032ec797df6869b3f58592ba13 libtinfo-dev_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 5c70a3bd69463315736d90ee10804b656b487d3e libtinfo5_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb dd3a91b00b70993e7e6c185e073a45cabe0f8206 libtinfo6_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 48b6e5d3b41f1a6336d30ec979b9c9601b5936f0 ncurses-base_6.2+20201114-2+deb11u2+tuxcare.els1_all.deb 5046c851b12dba7602eaa3fe54840b28cb18a2f0 ncurses-bin_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb 288ddd8d703e7187cee91ab8a95f4ce2171a1c60 ncurses-doc_6.2+20201114-2+deb11u2+tuxcare.els1_all.deb 5214e12a5fed94f9cbf75ae1e5bc32a417d79333 ncurses-examples_6.2+20201114-2+deb11u2+tuxcare.els1_amd64.deb e8be3742322967d6c5d641e6de0c612f9bbf4564 ncurses-term_6.2+20201114-2+deb11u2+tuxcare.els1_all.deb a557b9fdc974fed20480e488eefbc44babd4be01 libncurses-dev_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 4ea9f52f278dd926c37b4ec6fab0d3201fe5f22f libncurses5_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 4c0ff9926cbfd928d14287e471ad831fee249a29 libncurses5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb a04efb005c888f20889ff973ab08409817a12a68 libncurses6_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 609ed30b472808a7dd586cb30c460fdd70c41aea libncursesw5_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 5e0ef784a5f8627c3cf34d37ced96ba5ba2c621a libncursesw5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb c24901abf4f43eb921863d832ea53f25013c4693 libncursesw6_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb d16cecd5f72d8aead88ec0275d5c2ad262c1392f libtinfo-dev_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 2ec7fba84fc35bec4320d61f23f1cf358f5deede libtinfo5_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb 91c4b8016e6d74f14659c9ee4bebfc55437d8e09 libtinfo6_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb b0525e4d3a7c96e4a7fe99ea0d2685ebab049464 ncurses-bin_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb ead429d30fdd6a4d471edc0793786f977cf68aea ncurses-examples_6.2+20201114-2+deb11u2+tuxcare.els1_arm64.deb c49311f45e5c70a7d4e864296fc51e6990c79159 libncurses-dev_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 5c65978c1201b7b7cc423c9c789375aee84ae30b libncurses5_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 04dc2722e2ee6afae13c6041c18f592ed4c88c63 libncurses5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 243a2534415a928576c23fd94cc9b72af5072db5 libncurses6_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 5ffce1ced82d71286e1af0b69f577c7c6a6e0ee6 libncursesw5_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb b081b7b75f11da9467fcdfc69c863a830a0ebc92 libncursesw5-dev_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb e4d44dd56ba5cafac49ef16f52eed8798f863497 libncursesw6_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 78a74b0a55c16f82946ffc0f42fe4f022df1769f libtinfo-dev_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 3c79590d05f9154857a0cf287894d86a7a7f0a88 libtinfo5_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 53a9051ae1a070949ac67270d967a3a50630ffc4 libtinfo6_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 44d86a854fc6ddc7dc6b19449f97d1e0d31dfe91 ncurses-bin_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 4858214ec7195824bb13ec52316da0476fdcee7b ncurses-examples_6.2+20201114-2+deb11u2+tuxcare.els1_armel.deb 459c2da31fd03eaf42da8929cd53263f009d3851 CLSA-2026:1789461431 TuxCare License Agreement 0 * SECURITY UPDATE: HTTP/2 requests without an authority bypassed strict SNI validation - the fix for CVE-2026-32990 required an authority only for CONNECT requests, so a request using any other method could omit it and evade the host check - debian/patches/CVE-2026-65637.patch: treat a missing serverName as a missing header for all non-CONNECT HTTP/2 requests in receivedEndOfHeaders() - CVE-2026-65637 * SECURITY UPDATE: Denial of service via an allocation leak in the HTTP/2 backlog - resetting a stream that was waiting on the connection window left its reservation counted in the backlog and its allocation unreturned, so repeated resets exhausted the connection window and stalled the connection - debian/patches/CVE-2026-68763.patch: remove a replaced stream from the backlog and return its unused allocation to the connection window, decrement backLogSize when allocating, and skip streams that can no longer write - CVE-2026-68763 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: HTTP/2 requests without an authority bypassed strict SNI validation - the fix for CVE-2026-32990 required an authority only for CONNECT requests, so a request using any other method could omit it and evade the host check - debian/patches/CVE-2026-65637.patch: treat a missing serverName as a missing header for all non-CONNECT HTTP/2 requests in receivedEndOfHeaders() - CVE-2026-65637 * SECURITY UPDATE: Denial of service via an allocation leak in the HTTP/2 backlog - resetting a stream that was waiting on the connection window left its reservation counted in the backlog and its allocation unreturned, so repeated resets exhausted the connection window and stalled the connection - debian/patches/CVE-2026-68763.patch: remove a replaced stream from the backlog and return its unused allocation to the connection window, decrement backLogSize when allocating, and skip streams that can no longer write - CVE-2026-68763

0 tuxcare-debian11-els libtomcat9-embed-java_9.0.118-0+deb11u1+tuxcare.els1_all.deb ac6bb0bc1ddd48d1868183573840294199ac33b3 libtomcat9-java_9.0.118-0+deb11u1+tuxcare.els1_all.deb a938437e735e22bb7b332c5a3b094dee61cd207a tomcat9_9.0.118-0+deb11u1+tuxcare.els1_all.deb 2406e57b4b888894f8e39f093884290592daa2b5 tomcat9-admin_9.0.118-0+deb11u1+tuxcare.els1_all.deb 2411440f8c959d1e8f2d54b9511b9cf077bb4cfa tomcat9-common_9.0.118-0+deb11u1+tuxcare.els1_all.deb 11c259cec9daaf726d1100440d80a6ce780382c5 tomcat9-docs_9.0.118-0+deb11u1+tuxcare.els1_all.deb 89d9fbe7f00dfb9255f3ef8280686cb0dd336180 tomcat9-examples_9.0.118-0+deb11u1+tuxcare.els1_all.deb be77e2ac3e27c4d89dd344fd7dd75428f85feabb tomcat9-user_9.0.118-0+deb11u1+tuxcare.els1_all.deb 048bc6ed3855d069d367eafce25426609d745582 CLSA-2026:1789463064 TuxCare License Agreement 0 * SECURITY UPDATE: Heap-based buffer overflow in block insert - debian/patches/CVE-2022-0318.patch: only use the multi-byte head offset to correct the offset in block_insert() in src/ops.c, adjust the expected block-insert output in src/testdir/test_utf8.vim, add test in src/testdir/test_visual.vim, add patch numbers in src/version.c; also clamp a negative space count in block_insert() in src/ops.c, as upstream 8.2.3073 does and as debian10els already carries (Debian #1023818) - CVE-2022-0318 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap-based buffer overflow in block insert - debian/patches/CVE-2022-0318.patch: only use the multi-byte head offset to correct the offset in block_insert() in src/ops.c, adjust the expected block-insert output in src/testdir/test_utf8.vim, add test in src/testdir/test_visual.vim, add patch numbers in src/version.c; also clamp a negative space count in block_insert() in src/ops.c, as upstream 8.2.3073 does and as debian10els already carries (Debian #1023818) - CVE-2022-0318

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb 70c03b4d15f1965f86371ad505eef07f1e4074f2 vim-athena_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb dc2ab229345bb87b4b524400726e5163aab39475 vim-common_8.2.2434-3+deb11u3+tuxcare.els4_all.deb b56cdf533445a66fbb18314ac52b2041b66d6500 vim-doc_8.2.2434-3+deb11u3+tuxcare.els4_all.deb 1957698be3d66fde0f908f996fd2499b02dd3d3a vim-gtk_8.2.2434-3+deb11u3+tuxcare.els4_all.deb 43cfa52d48a34c51a43fc8c77a1c543a8016be60 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb 355fb99bb63f74141ff5c90d3e417706578452ea vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els4_all.deb 4d856dfef6453e544941f867fb7efe5fa387e03c vim-nox_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb 80ef4258daa6372d343d186d3b7a822451bea0b5 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els4_all.deb 47eda4ded5ff4f39fac6d758b06762d541c080e2 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb 204a242eecb466ae556269c6ad5a728ded5ecfa9 xxd_8.2.2434-3+deb11u3+tuxcare.els4_amd64.deb a9a4892cfdc3a322fbd5f334a44f2ea75ae33933 vim_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb 172a9948768bd3745a1d8f95b9e161dd2aa31d99 vim-athena_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb 148aec5defc4f7543049ffcd315d1e9dc1d19c08 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb 81f9a4f5f8d7bbb332fbbbf41f7d81bdea4ba286 vim-nox_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb 5b19b01f30edc449be7910cc01d254a7fb9eba3d vim-tiny_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb 087efbfd1ce9f8b6fefd0bda50fbb41472f94624 xxd_8.2.2434-3+deb11u3+tuxcare.els4_arm64.deb e08e90b370dca9c6fe034dcd67fd16651e178e91 vim_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb b3d18f3b9b18ea0eeb41012842feaf73618557a1 vim-athena_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb 0659f1fd455455e67f05ccb96d5563468fd6e5c9 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb 946cd98418695d410e5497d4abd6aa7bda0737eb vim-nox_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb 1d8505589ea4131d7836e81ea87948801ba43fc5 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb f7c66b80de0a3cacf1ec84fbab186ef6603b5c27 xxd_8.2.2434-3+deb11u3+tuxcare.els4_armel.deb 2fee99d07ce361178387aa33f03025636d03e142 CLSA-2026:1789479755 TuxCare License Agreement 0 * SECURITY UPDATE: Memory leak in the sqlite3_exec() error message on colord database open - debian/patches/CVE-2021-42523.patch: Pass NULL instead of an error message buffer to the properties_v2 schema check in cd_device_db_load() in src/cd-device-db.c and to the properties_pu schema check in cd_profile_db_load() in src/cd-profile-db.c, so SQLite no longer allocates an error message that neither function frees - CVE-2021-42523 * Stop colord-test-private timing out on the 32-bit builders - debian/rules: pass --timeout-multiplier 10 to meson test; the suite only reached 9 of its 38 subtests inside meson's default 30s ceiling on armel, while amd64 completes it in 6s Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Memory leak in the sqlite3_exec() error message on colord database open - debian/patches/CVE-2021-42523.patch: Pass NULL instead of an error message buffer to the properties_v2 schema check in cd_device_db_load() in src/cd-device-db.c and to the properties_pu schema check in cd_profile_db_load() in src/cd-profile-db.c, so SQLite no longer allocates an error message that neither function frees - CVE-2021-42523 * Stop colord-test-private timing out on the 32-bit builders - debian/rules: pass --timeout-multiplier 10 to meson test; the suite only reached 9 of its 38 subtests inside meson's default 30s ceiling on armel, while amd64 completes it in 6s

0 tuxcare-debian11-els colord_1.4.5-3+tuxcare.els1_amd64.deb e59990982761a10a350ece30d79461fb1e3bd068 colord-data_1.4.5-3+tuxcare.els1_all.deb ba1ff101adf91a01182e57ac823a70cadeed806c colord-tests_1.4.5-3+tuxcare.els1_amd64.deb fd3a681d0b70595b5099afdc5250420f0fd51af1 gir1.2-colord-1.0_1.4.5-3+tuxcare.els1_amd64.deb 48b4218ed4b6862b0808f82e8f1b8f6cf62fa466 gir1.2-colorhug-1.0_1.4.5-3+tuxcare.els1_amd64.deb 75c2fe4870d7a4954d2fca6e84761e302437aaa2 libcolord-dev_1.4.5-3+tuxcare.els1_amd64.deb 4c0687b079be5313d17927faa47cc4e8bde12f46 libcolord2_1.4.5-3+tuxcare.els1_amd64.deb 831cd7c1d3b635bf7ec5862dceaca81ab2b79340 libcolorhug-dev_1.4.5-3+tuxcare.els1_amd64.deb 77eeff6dea00a178f9eef6b63a3d3c90b29e36cf libcolorhug2_1.4.5-3+tuxcare.els1_amd64.deb a854c5d9fc4675819f0ab8e9ebbcf519adbf99ee colord_1.4.5-3+tuxcare.els1_arm64.deb 0c69251d261b1b233b201700c2e3d97f22f82e7b colord-tests_1.4.5-3+tuxcare.els1_arm64.deb f5370f5e6bd40f52c39e5cae2ffe607545c6c91a gir1.2-colord-1.0_1.4.5-3+tuxcare.els1_arm64.deb 69f128a8218b27c87021a0f8208b238d5c4798eb gir1.2-colorhug-1.0_1.4.5-3+tuxcare.els1_arm64.deb 5ba5e95864e2b2f935121bb3fb9d9f6e4b56d32b libcolord-dev_1.4.5-3+tuxcare.els1_arm64.deb 7fce223b6bc48667efede78543cb7a4712b6792a libcolord2_1.4.5-3+tuxcare.els1_arm64.deb ad07801360185b38168784cd77dc0b69e9a762a1 libcolorhug-dev_1.4.5-3+tuxcare.els1_arm64.deb ed513401abf4c46f0f569cdad07101b9534423ff libcolorhug2_1.4.5-3+tuxcare.els1_arm64.deb 14eb91ea34b911b9f30e2d8566f9b77990465c62 colord_1.4.5-3+tuxcare.els1_armel.deb 3d2c3f28c0afbb0ba67130d6e1f4d68b77ff7fc3 colord-tests_1.4.5-3+tuxcare.els1_armel.deb f81a9e6897e9907c053389b00582f762e08960cf gir1.2-colord-1.0_1.4.5-3+tuxcare.els1_armel.deb 2a5ebde5586b2fa81b9b4938bb5e6544d4a2d5e2 gir1.2-colorhug-1.0_1.4.5-3+tuxcare.els1_armel.deb 42e826dbfa9580080f72295047993d34c78bf8f9 libcolord-dev_1.4.5-3+tuxcare.els1_armel.deb 965d33d4ed7dd36cbd6b59085aed78ff462445a8 libcolord2_1.4.5-3+tuxcare.els1_armel.deb 6239f957952607369db20b0ffa19749e090bea55 libcolorhug-dev_1.4.5-3+tuxcare.els1_armel.deb 5c59ef194395b61cf6884747006d678e7f5f5d5e libcolorhug2_1.4.5-3+tuxcare.els1_armel.deb de8318bd663856f0269ca94c0b63510937272c0c CLSA-2026:1789483920 TuxCare License Agreement 0 * SECURITY UPDATE: Use of undefined buffer content in bsdtar verbose listing - debian/patches/CVE-2025-25724.patch: check the strftime return value and the localtime result in list_item_verbose in tar/util.c, printing "-- -- ----" instead of undefined buffer content - CVE-2025-25724 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Use of undefined buffer content in bsdtar verbose listing - debian/patches/CVE-2025-25724.patch: check the strftime return value and the localtime result in list_item_verbose in tar/util.c, printing "-- -- ----" instead of undefined buffer content - CVE-2025-25724

0 tuxcare-debian11-els libarchive-dev_3.4.3-2+deb11u5+tuxcare.els1_amd64.deb b6760178cbec620652d2a552c4e57dc4c7c55ce7 libarchive-tools_3.4.3-2+deb11u5+tuxcare.els1_amd64.deb 4d0ef563bec28f316e3b14d69bf714dc6044a63d libarchive13_3.4.3-2+deb11u5+tuxcare.els1_amd64.deb 775a22cff3e735350d7380ffb3b546d26343d774 libarchive-dev_3.4.3-2+deb11u5+tuxcare.els1_arm64.deb 692ed25a6baf1035d5f6a99b38bbae7555ce79bd libarchive-tools_3.4.3-2+deb11u5+tuxcare.els1_arm64.deb ff7c6cf82e18cb054cfebc3fb54d2b9bf6521680 libarchive13_3.4.3-2+deb11u5+tuxcare.els1_arm64.deb 9783ef3c55a705630b0d81adbe3bfa274c31f7af libarchive-dev_3.4.3-2+deb11u5+tuxcare.els1_armel.deb bd4b2c9b1037a7239c716ed8124e0b0feeeba259 libarchive-tools_3.4.3-2+deb11u5+tuxcare.els1_armel.deb 397cfe81b05a12a4f8570b3d335641d901a8913a libarchive13_3.4.3-2+deb11u5+tuxcare.els1_armel.deb e7c2126a8adae97c82d43af01e0a505cf972eeea CLSA-2026:1789486509 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds read via a malformed plugin config file - debian/patches/CVE-2023-46045.patch: detect an unknown plugin API in gvconfig_plugin_install_from_config() in lib/gvc/gvconfig.c and fail with an error instead of indexing the API array out of bounds - CVE-2023-46045 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds read via a malformed plugin config file - debian/patches/CVE-2023-46045.patch: detect an unknown plugin API in gvconfig_plugin_install_from_config() in lib/gvc/gvconfig.c and fail with an error instead of indexing the API array out of bounds - CVE-2023-46045

0 tuxcare-debian11-els graphviz_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb e94e311ddb92501046613fd69b41ee2152d5055b graphviz-doc_2.42.2-5+deb11u1+tuxcare.els1_all.deb df1ae1af3103f4beb797a48aa7bb13356cf0855a libcdt5_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 6b187e15b0c7afe9fdfdadfa734eefa680dae932 libcgraph6_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 418ae4ebc6cb6b6939e4862bc0d716f1481ca61f libgraphviz-dev_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 656e60aec68a02e5ae6862520748b052decc84cf libgv-guile_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb ed13965015f69c929f72171094c4d0328cae69d7 libgv-lua_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 79855b6467374545811b78139376960c93b21e1c libgv-perl_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb a389d8bfdb5a40bf1c9e1c144e571fc124ccc4dc libgv-php7_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb ac806ffa103fe9e64ba6e3573a42bcc2f22414ce libgv-ruby_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 9a649906c086b03d2c9b4b2cc51fa0a03dc05840 libgv-tcl_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 22aa8a014b26d6ecedd80c825c02141bcc50ed09 libgvc6_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 002cafde428ae7df6a8aa8959f9ae6ed58e52567 libgvc6-plugins-gtk_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 8beab2966738ef95fffa3b4258e33a8c822e491b libgvpr2_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb e0e33699121b21525407401a8e6a332b88169d11 liblab-gamut1_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb c336b5655823d2fa899e03b5b53929530a4b0fa0 libpathplan4_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 1afbcdd5fb0702fbce59f18a540a7531d526572c libxdot4_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb ee1f540e5ab7fec8900cfb4552d85392fc4e828f python3-gv_2.42.2-5+deb11u1+tuxcare.els1_amd64.deb 11e0bf5ffb72f08813b4ca7d1bad4f82d64aa696 graphviz_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb ff44c9e6bcbc81021521c050a240c1e0fe099ca5 libcdt5_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 54f271db7fe4dc057ccc932604e9e046c0d3a967 libcgraph6_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 740706afaf2060c78c680fc25298860dff5f8c63 libgraphviz-dev_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb baf258576193ad238037e46dac1ea185297f286d libgv-guile_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 31e88c223e5018d4a233169b81c2403226b3b619 libgv-lua_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 4c8a29cbc94eebfaa1f56a81a59c706df467c2d7 libgv-perl_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 0a152a57b22de7ce20f4bfed6492b779b48a9c7f libgv-php7_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 5ed59558a60991b9bca1cde8a0df4c111d6f78c5 libgv-ruby_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 81fc66976aa76126a12c828dc0dd597cebbd353e libgv-tcl_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb bce6e4d650f3a3345dcc4e61200d42bd6c50055a libgvc6_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 7eed7e1da274647f4be6bdc3803222ecc0f6e0b8 libgvc6-plugins-gtk_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb d20e4f00d60a59326af05a65568cae157160af70 libgvpr2_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 593e635fb704086dfe212fc283cf292dbb68d49c liblab-gamut1_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb d476e863bbe8e891ba866ae9c3ba72e31a8d1724 libpathplan4_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 9dc71f473287dbe62a902f745d7e4b0c72535cee libxdot4_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 964d20242ae1e068419d29e2660838b2bfae8112 python3-gv_2.42.2-5+deb11u1+tuxcare.els1_arm64.deb 3d00d69b7079615bb096d75ab55e5122b51a7dca graphviz_2.42.2-5+deb11u1+tuxcare.els1_armel.deb ee827030dc512283f086d8b90dc97d3fae62d842 libcdt5_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 19224ac6121b17ad7bb46aa7552a9854fbe90332 libcgraph6_2.42.2-5+deb11u1+tuxcare.els1_armel.deb a08ce9b1e8f00e8e1883b510484eb18ba32c5651 libgraphviz-dev_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 142850daf0d8cf5a225a131c4f749c3ba6806597 libgv-guile_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 5eba71b43ce56bd89b91705a3fc3274f1221cc68 libgv-lua_2.42.2-5+deb11u1+tuxcare.els1_armel.deb db77584c00ad9ba140860228029675bde0e950ac libgv-perl_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 9f5bd6ef43c277cf979f8d1a68cbe25726440726 libgv-php7_2.42.2-5+deb11u1+tuxcare.els1_armel.deb cebc5c81f85563b31b2e6b3c68696ae8b9746ce1 libgv-ruby_2.42.2-5+deb11u1+tuxcare.els1_armel.deb cb42342b92556c23ce126026700a8d482d8ced2d libgv-tcl_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 3e5cc48b252e29142345720f57c3d2997050742e libgvc6_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 95af72ff4569900357a116853e8c65c31563837f libgvc6-plugins-gtk_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 4670d1a215b9882547a67c86e4ff3d3dfddc1624 libgvpr2_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 3acceb020ad1f43432e3654670c87646d313ee14 liblab-gamut1_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 202aaaa3006c2be37bbfea94e57cc1d93adaa972 libpathplan4_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 92009731044dc9efd1e418ecd8d4d4cf06c6f0f5 libxdot4_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 014083df7f9f1da2d42b85e9d4f463247ad7959f python3-gv_2.42.2-5+deb11u1+tuxcare.els1_armel.deb 784ecae3d507e83afb16211b3924c431c8d3059d CLSA-2026:1789486843 TuxCare License Agreement 0 * SECURITY UPDATE: Crash in pdfinfo -dests on broken documents - debian/patches/CVE-2024-6239.patch: give the destination map ownership of its name strings and skip entries with a null name in utils/pdfinfo.cc - CVE-2024-6239 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Crash in pdfinfo -dests on broken documents - debian/patches/CVE-2024-6239.patch: give the destination map ownership of its name strings and skip entries with a null name in utils/pdfinfo.cc - CVE-2024-6239

0 tuxcare-debian11-els gir1.2-poppler-0.18_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb e8fa2c6c9419b126195e4aeb9bf199e12d0ae5a3 libpoppler-cpp-dev_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb ccd292551f01672d5aeed4a6a733912e36e51a4b libpoppler-cpp0v5_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb fa0e407a2a9f1eed544c27a614575045dbf4b0ff libpoppler-dev_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 21df8ef8d1aeeb4481c4cca19143119d3d360acb libpoppler-glib-dev_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 811d9f2847f7325f084a02451be4c43860d6c04b libpoppler-glib-doc_20.09.0-3.1+deb11u3+tuxcare.els1_all.deb 9501eadfcea3d0e65beb9a713a16f84264a1d6ca libpoppler-glib8_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 1ccb39016403a606ee4a6ed021401e948f27a88d libpoppler-private-dev_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb e1a4203e214c9e8c253113f7b4a0ff265d0659fe libpoppler-qt5-1_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb f0eb469b87ef0548de665ddf678ed15873fdd6d5 libpoppler-qt5-dev_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 1685d64b103e5c76a825004c4d17d939ca8074db libpoppler102_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 0c1a97c14a069156faeaf29a9edaec50924b834d poppler-utils_20.09.0-3.1+deb11u3+tuxcare.els1_amd64.deb 96f3b361f4a2fe3eb0574fff37e81c4f9a332cc3 gir1.2-poppler-0.18_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 11473bd526b71ce8bf2ce38f1a6437461014bb9e libpoppler-cpp-dev_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 2cccf803a921c1e07a9496b57155b72abaa47def libpoppler-cpp0v5_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 6f57b4a8a8641875eeff9d73fed09129e960dfe0 libpoppler-dev_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb a69cc686ea68d846bfdc0853a5e5826cb40eb0a2 libpoppler-glib-dev_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 20db629b6fd18d9054af62d1fe744170c32ed5a7 libpoppler-glib8_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 6ecefc61c19937ffdd96806ce23a31692fe34a4e libpoppler-private-dev_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 78e6f74a9f488572886559a2a13e64090051a04b libpoppler-qt5-1_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 046292b51d5d7c9101d6147b01e9cfb837c91dea libpoppler-qt5-dev_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 3786e3b66f94ca62cc2098ee16d641007ddab53c libpoppler102_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 6a9ccee5f9aaf055f2e95f32eb4f76d234f05137 poppler-utils_20.09.0-3.1+deb11u3+tuxcare.els1_arm64.deb 060203d4b2df3ae556336e43af42153c76242793 gir1.2-poppler-0.18_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 27ad5d52b5512c81a95bbca2410db0f4131ff90d libpoppler-cpp-dev_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 3ebef481b55d5515a0bafcbdb02854de32164ca6 libpoppler-cpp0v5_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 33418a90c22bd77d0a8234750961c97d2c6835a6 libpoppler-dev_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb f9c860a7a598e42ed463699a8acc184c054eccb7 libpoppler-glib-dev_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 6df6b3a1052a0b11708d7948f1da261aae13298e libpoppler-glib8_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb e16d49e9e589bb86caf75d82787187f071276d3b libpoppler-private-dev_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 9fbecd20c6968086f95cdb9a428071c20c2be196 libpoppler-qt5-1_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb aa69eccfc65aed272dfe15f6db0edfa60d24c7fb libpoppler-qt5-dev_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb c63866f7226f312675320ccd512e486068057db3 libpoppler102_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 553d914b88ec0b5512fa93a6aa375cc66a9a27c3 poppler-utils_20.09.0-3.1+deb11u3+tuxcare.els1_armel.deb 4d3bb5845ffda1da6b7f04e49a81d50a2f52af97 CLSA-2026:1789552364 TuxCare License Agreement 0 * SECURITY UPDATE: path traversal in Archive::Tar via unvalidated symlink and hardlink targets in the tar header - debian/patches/CVE-2026-42496.patch: reject absolute and escaping '..' link targets in Archive::Tar::_make_special_file() unless $Archive::Tar::INSECURE_EXTRACT_MODE is set, resolving the target through _symlinks_resolver() so links that stay inside the extraction directory keep working - CVE-2026-42496 * SECURITY UPDATE: memory exhaustion in Archive::Tar via an attacker-controlled entry size field in the tar header - debian/patches/CVE-2026-9538.patch: cap the per-entry declared size in Archive::Tar::_read_tar() with $Archive::Tar::MAX_FILE_SIZE (default 1 GiB), refusing the entry before the read buffer is allocated - CVE-2026-9538 * SECURITY UPDATE: arbitrary code execution in File::GlobMapper via an attacker-controlled output glob - debian/patches/CVE-2026-48962.patch: replace the eval STRING in File::GlobMapper::_getFiles() with literal substitution of the internal markers set up by _parseOutputGlob() in cpan/IO-Compress/lib/File/GlobMapper.pm - CVE-2026-48962 * SECURITY UPDATE: integer overflow when computing a pack/unpack template structure size - debian/patches/CVE-2026-57432.patch: croak in S_measure_struct() in pp_pack.c when the computed structure size would overflow SSize_t, and document the new diagnostic in pod/perldiag.pod - CVE-2026-57432 * SECURITY UPDATE: signed integer overflow when deserializing a crafted Storable SX_HOOK record - debian/patches/CVE-2026-57433.patch: reject a hook data item count of I32_MAX in retrieve_hook_common() in dist/Storable/Storable.xs before it is incremented and passed to av_extend() - CVE-2026-57433 * SECURITY UPDATE: HTTP::Tiny did not verify TLS certificates by default - debian/patches/CVE-2023-31486.patch: default verify_SSL to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm and add the PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT escape hatch, matching HTTP::Tiny 0.083 - CVE-2023-31486 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: path traversal in Archive::Tar via unvalidated symlink and hardlink targets in the tar header - debian/patches/CVE-2026-42496.patch: reject absolute and escaping '..' link targets in Archive::Tar::_make_special_file() unless $Archive::Tar::INSECURE_EXTRACT_MODE is set, resolving the target through _symlinks_resolver() so links that stay inside the extraction directory keep working - CVE-2026-42496 * SECURITY UPDATE: memory exhaustion in Archive::Tar via an attacker-controlled entry size field in the tar header - debian/patches/CVE-2026-9538.patch: cap the per-entry declared size in Archive::Tar::_read_tar() with $Archive::Tar::MAX_FILE_SIZE (default 1 GiB), refusing the entry before the read buffer is allocated - CVE-2026-9538 * SECURITY UPDATE: arbitrary code execution in File::GlobMapper via an attacker-controlled output glob - debian/patches/CVE-2026-48962.patch: replace the eval STRING in File::GlobMapper::_getFiles() with literal substitution of the internal markers set up by _parseOutputGlob() in cpan/IO-Compress/lib/File/GlobMapper.pm - CVE-2026-48962 * SECURITY UPDATE: integer overflow when computing a pack/unpack template structure size - debian/patches/CVE-2026-57432.patch: croak in S_measure_struct() in pp_pack.c when the computed structure size would overflow SSize_t, and document the new diagnostic in pod/perldiag.pod - CVE-2026-57432 * SECURITY UPDATE: signed integer overflow when deserializing a crafted Storable SX_HOOK record - debian/patches/CVE-2026-57433.patch: reject a hook data item count of I32_MAX in retrieve_hook_common() in dist/Storable/Storable.xs before it is incremented and passed to av_extend() - CVE-2026-57433 * SECURITY UPDATE: HTTP::Tiny did not verify TLS certificates by default - debian/patches/CVE-2023-31486.patch: default verify_SSL to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm and add the PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT escape hatch, matching HTTP::Tiny 0.083 - CVE-2023-31486

0 tuxcare-debian11-els libperl-dev_5.32.1-4+deb11u5+tuxcare.els4_amd64.deb 1a6956afb227bedc374aa9250dd54ac476b6264b libperl5.32_5.32.1-4+deb11u5+tuxcare.els4_amd64.deb 0ecc5ff0c3598f3b0f874a3aa259ff4f91b7a2f3 perl_5.32.1-4+deb11u5+tuxcare.els4_amd64.deb d257dfc5c365323e855091dca771e75f528a6502 perl-base_5.32.1-4+deb11u5+tuxcare.els4_amd64.deb 09183484d8f499759c147b7c53d9b5c09db08549 perl-debug_5.32.1-4+deb11u5+tuxcare.els4_amd64.deb 6e0e3a727492b7661f61bf9db60b88bc2bbf6506 perl-doc_5.32.1-4+deb11u5+tuxcare.els4_all.deb eb69eaede7bd086a82600297c4fbb569e72fe95a perl-modules-5.32_5.32.1-4+deb11u5+tuxcare.els4_all.deb 3d33d8119478b00f31d4ca105cb9689a61bb305d libperl-dev_5.32.1-4+deb11u5+tuxcare.els4_arm64.deb f4446402007ddaa6b6257d12992d1825d5cbdc78 libperl5.32_5.32.1-4+deb11u5+tuxcare.els4_arm64.deb 6db8bb9b23a56793f9ad75d0d737321b9759df92 perl_5.32.1-4+deb11u5+tuxcare.els4_arm64.deb 324230b84416841567f66bb26a102c0d68ebe56a perl-base_5.32.1-4+deb11u5+tuxcare.els4_arm64.deb d07e459c52d252d7bc95b7ce78d0fedf01edeb7b perl-debug_5.32.1-4+deb11u5+tuxcare.els4_arm64.deb 23a61e7ba75a0e87ef15e5f7e9387351133ec6fd libperl-dev_5.32.1-4+deb11u5+tuxcare.els4_armel.deb 9d9ba18c338067cd0a41668ddd0ca9ee3116fe2d libperl5.32_5.32.1-4+deb11u5+tuxcare.els4_armel.deb a250244445433c78f46478c1f3ae3af24461f4d6 perl_5.32.1-4+deb11u5+tuxcare.els4_armel.deb 1a5360a3ef627521cfaabdbb75d9035baa927c27 perl-base_5.32.1-4+deb11u5+tuxcare.els4_armel.deb ef8e14ec2d669e08816610c94fdc931523c80528 perl-debug_5.32.1-4+deb11u5+tuxcare.els4_armel.deb c8d4fe04d03b8e43401c8abbaabeb08e09465c2f CLSA-2026:1789566857 TuxCare License Agreement 0 * SECURITY UPDATE: a mailto: URI could silently attach a local file when Thunderbird was the configured handler - debian/patches/CVE-2022-4055.patch: remove the Thunderbird special case (run_thunderbird() and its callers) from scripts/xdg-email.in, so mailto: URIs go to the desktop handler and no URI field is parsed; the --attach option is dropped with it - debian/patches/tests-xdg-email-thunderbird-passthrough.patch: rewrite the autotest case that asserted the removed Thunderbird path so it asserts the fixed behaviour instead - CVE-2022-4055: unquoted subject= and body= in run_thunderbird() let a mailto: URI append a -compose attachment= argument - CVE-2020-27748: the attach= field of a mailto: URI was passed straight through to -compose attachment= Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: a mailto: URI could silently attach a local file when Thunderbird was the configured handler - debian/patches/CVE-2022-4055.patch: remove the Thunderbird special case (run_thunderbird() and its callers) from scripts/xdg-email.in, so mailto: URIs go to the desktop handler and no URI field is parsed; the --attach option is dropped with it - debian/patches/tests-xdg-email-thunderbird-passthrough.patch: rewrite the autotest case that asserted the removed Thunderbird path so it asserts the fixed behaviour instead - CVE-2022-4055: unquoted subject= and body= in run_thunderbird() let a mailto: URI append a -compose attachment= argument - CVE-2020-27748: the attach= field of a mailto: URI was passed straight through to -compose attachment=

0 tuxcare-debian11-els xdg-utils_1.1.3-4.1+tuxcare.els1_all.deb cd97cff3b1983d5a574189d1ebfed41ae2e5837d CLSA-2026:1789567019 TuxCare License Agreement 0 * SECURITY UPDATE: Memory leak when a HEADERS or PUSH_PROMISE frame cannot be sent and the stream close callback fails fatally - debian/patches/CVE-2023-35945.patch: free the outbound item and reset the active outbound item before returning the fatal error from nghttp2_session_close_stream in lib/nghttp2_session.c, add regression test in tests/nghttp2_session_test.c - CVE-2023-35945 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Memory leak when a HEADERS or PUSH_PROMISE frame cannot be sent and the stream close callback fails fatally - debian/patches/CVE-2023-35945.patch: free the outbound item and reset the active outbound item before returning the fatal error from nghttp2_session_close_stream in lib/nghttp2_session.c, add regression test in tests/nghttp2_session_test.c - CVE-2023-35945

0 tuxcare-debian11-els libnghttp2-14_1.43.0-1+deb11u3+tuxcare.els1_amd64.deb f558839cb8219e867ffc819a65267421f08aaf33 libnghttp2-dev_1.43.0-1+deb11u3+tuxcare.els1_amd64.deb c6cfebc96ec41dded9875dfc95172fb7d70e5f3c libnghttp2-doc_1.43.0-1+deb11u3+tuxcare.els1_all.deb 12c285cb8c8f8aeec0643c3ce61a8358813e9a83 nghttp2_1.43.0-1+deb11u3+tuxcare.els1_all.deb d37fe11e250521dbf62c3797e5e8203e504e312a nghttp2-client_1.43.0-1+deb11u3+tuxcare.els1_amd64.deb 8a188f27ab7c3cb747b0ccfaf1cb697aea051529 nghttp2-proxy_1.43.0-1+deb11u3+tuxcare.els1_amd64.deb c518d6814c45ac231a4423cf67d1699d0b673894 nghttp2-server_1.43.0-1+deb11u3+tuxcare.els1_amd64.deb 34d4bf3d1581395d16d017fb95afc6c69f40dbcc libnghttp2-14_1.43.0-1+deb11u3+tuxcare.els1_arm64.deb d8ca9d00bc8fdaf0fe633aa797359cf7f6f90ee1 libnghttp2-dev_1.43.0-1+deb11u3+tuxcare.els1_arm64.deb 5d1cd826c925c22bea5e2b291b34d38c2eb58812 nghttp2-client_1.43.0-1+deb11u3+tuxcare.els1_arm64.deb 59cf239bfbe4b6a1ef286334aca4bd3fda41654f nghttp2-proxy_1.43.0-1+deb11u3+tuxcare.els1_arm64.deb 3f5123e8c8faa350e480c5a7d7b8fdd6240bf1dc nghttp2-server_1.43.0-1+deb11u3+tuxcare.els1_arm64.deb 088553cf79637f538b81032e86b671e7ae99a42a libnghttp2-14_1.43.0-1+deb11u3+tuxcare.els1_armel.deb f7d425ff6c0c6b461beb1107cdc237db5c73f683 libnghttp2-dev_1.43.0-1+deb11u3+tuxcare.els1_armel.deb 26894b3b6eaf249c9095e3815b17d4957a28a615 nghttp2-client_1.43.0-1+deb11u3+tuxcare.els1_armel.deb 4038095ec4e741970eba9b268ab485aa306e3228 nghttp2-proxy_1.43.0-1+deb11u3+tuxcare.els1_armel.deb ddb86b33c56dffd639cc6eb5fa97bad888571888 nghttp2-server_1.43.0-1+deb11u3+tuxcare.els1_armel.deb 297a77f93665d57969c30779d6ae77ee7a291028 CLSA-2026:1789571397 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer overflow in the dictionary string pool via an oversized QName - debian/patches/CVE-2026-86138.patch: compute the pool growth in xmlDictAddQString() with size_t arithmetic and bail out when the requested size is not representable, so a prefix and name together exceeding 2^30 characters no longer wrap the "4 * (namelen + plen + 1)" product down to a few bytes and overflow the pool on the following copy - CVE-2026-86138 * SECURITY UPDATE: heap buffer overflow when evaluating an oversized XPointer expression - debian/patches/CVE-2026-86142.patch: take the length of the remaining XPointer expression with strlen() and reject anything not representable as an int before sizing the buffer in xmlXPtrEvalXPtrPart(). xmlStrlen() counts in a plain int on this branch and wraps for inputs above 2 GiB, and the loop that copies the expression into the buffer performs no capacity check of its own - CVE-2026-86142 * SECURITY UPDATE: negative length passed to output write callbacks - debian/patches/CVE-2026-86143.patch: reject buffer lengths above INT_MAX before narrowing them for the writecallback() argument, in both xmlOutputBufferWrite() and xmlOutputBufferWriteEscape() as well as xmlOutputBufferFlush(). Without this a buffer larger than 2 GiB reaches the callback as a negative int, which callbacks such as xmlFileWrite() convert straight into a huge size_t for fwrite() - CVE-2026-86143 * SECURITY UPDATE: XInclude processing ignored the document parse flags, dropping XML_PARSE_NONET - debian/patches/CVE-2026-86144.patch: pass the document's own parseFlags through xmlXIncludeProcess() and xmlXIncludeProcessTree() instead of hardcoding 0, and apply them to the parser context that xmlXIncludeLoadTxt() builds for parse="text" includes, so a caller that parsed with XML_PARSE_NONET no longer has that restriction silently dropped when XInclude references are resolved, on either the parse="xml" or the parse="text" path, which allowed remote resources to be fetched - CVE-2026-86144 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer overflow in the dictionary string pool via an oversized QName - debian/patches/CVE-2026-86138.patch: compute the pool growth in xmlDictAddQString() with size_t arithmetic and bail out when the requested size is not representable, so a prefix and name together exceeding 2^30 characters no longer wrap the "4 * (namelen + plen + 1)" product down to a few bytes and overflow the pool on the following copy - CVE-2026-86138 * SECURITY UPDATE: heap buffer overflow when evaluating an oversized XPointer expression - debian/patches/CVE-2026-86142.patch: take the length of the remaining XPointer expression with strlen() and reject anything not representable as an int before sizing the buffer in xmlXPtrEvalXPtrPart(). xmlStrlen() counts in a plain int on this branch and wraps for inputs above 2 GiB, and the loop that copies the expression into the buffer performs no capacity check of its own - CVE-2026-86142 * SECURITY UPDATE: negative length passed to output write callbacks - debian/patches/CVE-2026-86143.patch: reject buffer lengths above INT_MAX before narrowing them for the writecallback() argument, in both xmlOutputBufferWrite() and xmlOutputBufferWriteEscape() as well as xmlOutputBufferFlush(). Without this a buffer larger than 2 GiB reaches the callback as a negative int, which callbacks such as xmlFileWrite() convert straight into a huge size_t for fwrite() - CVE-2026-86143 * SECURITY UPDATE: XInclude processing ignored the document parse flags, dropping XML_PARSE_NONET - debian/patches/CVE-2026-86144.patch: pass the document's own parseFlags through xmlXIncludeProcess() and xmlXIncludeProcessTree() instead of hardcoding 0, and apply them to the parser context that xmlXIncludeLoadTxt() builds for parse="text" includes, so a caller that parsed with XML_PARSE_NONET no longer has that restriction silently dropped when XInclude references are resolved, on either the parse="xml" or the parse="text" path, which allowed remote resources to be fetched - CVE-2026-86144

0 tuxcare-debian11-els libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_amd64.deb 2b3a6d618c899a43c81c9fc4240de2ea26c5e3dc libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_amd64.deb d9e16d585ac0a2a5f8725a8a4e79a7e15c475349 libxml2-doc_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_all.deb 9ac00ea4e4f25b7c93510163cd3254d7e067a201 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_amd64.deb 027b9b96e79385dbd9332ed6593f58e5e8b5c7da python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_amd64.deb de75277ed2fb3b5f59451ac218de882cfea45b10 libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_arm64.deb 40298ee8a738b3caf888d6afcfca08df52afc414 libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_arm64.deb 57c1ead0bc877b7df4113a1b3ca27cc800d5bc95 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_arm64.deb f66197cd43110fda46455615f9ea6f7cb526b1b8 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_arm64.deb 023eccc512830a5b394b5f22134e7f428ba0796f libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_armel.deb 18ff6cfedbfbd439257e206ed184e614cc35ea72 libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_armel.deb ec998e7cf34e8ad5115e818879fbf55b1c2a7b7e libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_armel.deb 77794edb612af6884115bf178a63ee1e02954aef python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els2_armel.deb 9c5c6382a4e73f4f6a991a89a64c72ade6f56d05 CLSA-2026:1789573030 TuxCare License Agreement 0 * SECURITY UPDATE: Denial of service via quadratic mark attachment in GPOS - debian/patches/CVE-2023-25193.patch: memoize the last base glyph in MarkBasePos/MarkLigPos so backward search no longer rescans the buffer - CVE-2023-25193 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Denial of service via quadratic mark attachment in GPOS - debian/patches/CVE-2023-25193.patch: memoize the last base glyph in MarkBasePos/MarkLigPos so backward search no longer rescans the buffer - CVE-2023-25193

0 tuxcare-debian11-els gir1.2-harfbuzz-0.0_2.7.4-1+tuxcare.els1_amd64.deb 7b93c1d41b93b38664ef06add94dc7e64302bcf0 libharfbuzz-bin_2.7.4-1+tuxcare.els1_amd64.deb 2ebf26388457da3e6c9f93798c896c28230db71a libharfbuzz-dev_2.7.4-1+tuxcare.els1_amd64.deb 8b2f2b57f9e2a0ea7f4afa2b839437bb6fafaff8 libharfbuzz-doc_2.7.4-1+tuxcare.els1_all.deb e9ff5dc609f2b6adab0db4c49fe1749a85a66269 libharfbuzz-gobject0_2.7.4-1+tuxcare.els1_amd64.deb f63eb5c772269c65c3a0307ea78074eac55afa84 libharfbuzz-icu0_2.7.4-1+tuxcare.els1_amd64.deb 8e182e2a07a3f790206486e2fc709dff3906708a libharfbuzz0b_2.7.4-1+tuxcare.els1_amd64.deb 57964e56e8cad6c68f0973898c9ed00c771b6451 gir1.2-harfbuzz-0.0_2.7.4-1+tuxcare.els1_arm64.deb bccc13c69e1f6e18a5281f0769ef8b358ba0b31a libharfbuzz-bin_2.7.4-1+tuxcare.els1_arm64.deb e551e4bd03c3e5682117ee117a3f01fab0022baa libharfbuzz-dev_2.7.4-1+tuxcare.els1_arm64.deb 5b87267fda83d26746e8853b311ec889458ae3ea libharfbuzz-gobject0_2.7.4-1+tuxcare.els1_arm64.deb a92b07b8622844c1c89318215ed20a02ffdd2423 libharfbuzz-icu0_2.7.4-1+tuxcare.els1_arm64.deb 5c5dfe146eb61d8d3d1f46ae81fd22886d6caecc libharfbuzz0b_2.7.4-1+tuxcare.els1_arm64.deb a94b9622eafe81ae2c803bef4cb0d96e5120ef4c gir1.2-harfbuzz-0.0_2.7.4-1+tuxcare.els1_armel.deb a9302d281c69754ba7d37a01618aaba63c68cd25 libharfbuzz-bin_2.7.4-1+tuxcare.els1_armel.deb 85385e077e364fd17a73e3b83e634a3f85fa66a5 libharfbuzz-dev_2.7.4-1+tuxcare.els1_armel.deb a585103c84b12bc2a7e1817ef802687f93ce7483 libharfbuzz-gobject0_2.7.4-1+tuxcare.els1_armel.deb 5ad57a174ba7882e7e6864d9ea78f8ddf1b564e0 libharfbuzz-icu0_2.7.4-1+tuxcare.els1_armel.deb 087838e007cdf0c2557517f1e6823738e1ee6aa5 libharfbuzz0b_2.7.4-1+tuxcare.els1_armel.deb 820f6f60cbd210b17c4f79b6b7366da80f8d8a07 CLSA-2026:1789574775 TuxCare License Agreement 0 * SECURITY UPDATE: --dump-bin could overwrite an arbitrary existing file - debian/patches/CVE-2023-30630.patch: write the dump file in a single pass and create it with O_EXCL so an existing file is never clobbered - CVE-2023-30630 * Build on armel - debian/control: add armel to Architecture on dmidecode and dmidecode-udeb. The debian11-els platform builds amd64, arm64 and armel, and with armel absent from the list dh produced no binary artifacts there, so every build of this package failed that target with "dpkg-genbuildinfo: error: binary build with no binary artifacts found" - the pristine vendor import fails the same way - the omission is an artefact of Debian's opt-in architecture list, not a portability limit: armhf and arm64 were each added on request (#715139, #767965) and armel was simply never asked for. dmidecode has no inline assembly and no VFP dependency (its only float use is printf formatting of voltages, which soft-float handles), its arch-conditional code is confined to __ia64__, __aarch64__ and an x86-only entry-point fallback - none of which armel enters - and the primary path reads /sys/firmware/dmi/tables/smbios_entry_point, which is arch-neutral Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: --dump-bin could overwrite an arbitrary existing file - debian/patches/CVE-2023-30630.patch: write the dump file in a single pass and create it with O_EXCL so an existing file is never clobbered - CVE-2023-30630 * Build on armel - debian/control: add armel to Architecture on dmidecode and dmidecode-udeb. The debian11-els platform builds amd64, arm64 and armel, and with armel absent from the list dh produced no binary artifacts there, so every build of this package failed that target with "dpkg-genbuildinfo: error: binary build with no binary artifacts found" - the pristine vendor import fails the same way - the omission is an artefact of Debian's opt-in architecture list, not a portability limit: armhf and arm64 were each added on request (#715139, #767965) and armel was simply never asked for. dmidecode has no inline assembly and no VFP dependency (its only float use is printf formatting of voltages, which soft-float handles), its arch-conditional code is confined to __ia64__, __aarch64__ and an x86-only entry-point fallback - none of which armel enters - and the primary path reads /sys/firmware/dmi/tables/smbios_entry_point, which is arch-neutral

0 tuxcare-debian11-els dmidecode_3.3-2+tuxcare.els1_amd64.deb 3b7c06f369e84b694cb8d0994b281dacd2156369 dmidecode_3.3-2+tuxcare.els1_arm64.deb be77d9c035e23a2fd018a98e107d0123af698266 dmidecode_3.3-2+tuxcare.els1_armel.deb 8f823b5ef9d36753ce084d97493ab8592af5ad19 CLSA-2026:1789577104 TuxCare License Agreement 0 * SECURITY UPDATE: Buffer over-read in dsn_split() - debian/patches/CVE-2026-43964.patch: do not advance past the end of an enhanced status code that is not followed by other text, in src/global/dsn_util.c - CVE-2026-43964 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Buffer over-read in dsn_split() - debian/patches/CVE-2026-43964.patch: do not advance past the end of an enhanced status code that is not followed by other text, in src/global/dsn_util.c - CVE-2026-43964

0 tuxcare-debian11-els postfix_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 560d76be56d6b1f9a02acff25a412a09665fd442 postfix-cdb_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb f32e2bce1b6b094017aae3383aaede9b74b6f1ae postfix-doc_3.5.25-0+deb11u1+tuxcare.els1_all.deb ad01bfc2558a205cf4f26c2998ed35afe1949299 postfix-ldap_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 4e931195e6b5d678dbc5e8241c6437d6dda7f492 postfix-lmdb_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 79204cc949e6790312357f419314faabfb6fc860 postfix-mysql_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 9ce3318f061d164b2d523b0e39c06638e066be2a postfix-pcre_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 178f5324c950f6714bd766cc6810e6de2cdfe0f1 postfix-pgsql_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb 44a197b31d62cc075c914b684c4069f42f7c3345 postfix-sqlite_3.5.25-0+deb11u1+tuxcare.els1_amd64.deb fbb4b1449384b79dcfc99008e00328647494c44e postfix_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 74ccc39c1eca5d1d8084072ec071e5564b702683 postfix-cdb_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb e2e65b636c22a531d2a4754d4c1d1159fb327b45 postfix-ldap_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb fc53e577370bd09e2af97974c420c0aac6e6844c postfix-lmdb_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 5f39c2e9bd675135361e8f01b9c740b46fae3b58 postfix-mysql_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 40ca2ae9d77b7dd8eb67fbf173ef85e217cb5ca1 postfix-pcre_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 392f1d3bd05b277b5c7c032b3a4a00d4d8e17bbc postfix-pgsql_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 598395ede87991cb8bd1ecb9d7c67a68f3eee9fa postfix-sqlite_3.5.25-0+deb11u1+tuxcare.els1_arm64.deb 37a0e5b3ddd922df17c39fdbd78e97b26afb730a postfix_3.5.25-0+deb11u1+tuxcare.els1_armel.deb 0a5aef4bca0b8914d5c1185b276ec22551b33ed1 postfix-cdb_3.5.25-0+deb11u1+tuxcare.els1_armel.deb dddbc2153841bb7d50d8100f36dd34e76a576dd9 postfix-ldap_3.5.25-0+deb11u1+tuxcare.els1_armel.deb 7ffdf577fc843dd04e7e9603453d39ac6fb52f1a postfix-lmdb_3.5.25-0+deb11u1+tuxcare.els1_armel.deb b3e58c88233bfb9f63fba76ba6aea9c54a187e2a postfix-mysql_3.5.25-0+deb11u1+tuxcare.els1_armel.deb 5c243a4bb7b509284b3014633570575e55c8b06f postfix-pcre_3.5.25-0+deb11u1+tuxcare.els1_armel.deb f4b401a4fce91d8fb77e0c653c22300e2110b25a postfix-pgsql_3.5.25-0+deb11u1+tuxcare.els1_armel.deb a0dc61e0ee0236ea32129645a4d9404dd6ff8f11 postfix-sqlite_3.5.25-0+deb11u1+tuxcare.els1_armel.deb 81e4d856af592ae362fb25b7e5c4822c375eee1b CLSA-2026:1789577411 TuxCare License Agreement 0 * SECURITY UPDATE: integer overflows in Heimdal PAC parsing allow remote code execution on 32-bit platforms and denial of service elsewhere - debian/patches/CVE-2022-42898.patch: catch the overflows that result from adding PAC_INFO_BUFFER_SIZE when parsing a PAC, and add the 64-bit store/retrieve helpers the checks need - CVE-2022-42898 * SECURITY UPDATE: an AD DC accepts a PAC whose contents were tampered with, because the KDC does not verify a checksum over the whole ticket - debian/patches/CVE-2022-37967.patch: add the new PAC ticket checksum and verify it in the KDC and in the PAC validation paths - CVE-2022-37967 * SECURITY UPDATE: an unprivileged user can write the dNSHostName attribute of a computer account without the Validated-DNS-Host-Name right - debian/patches/CVE-2022-32743.patch: validate dNSHostName and servicePrincipalName writes in the acl module and connect to samdb as the workstation account in the netlogon server - CVE-2022-32743 * SECURITY UPDATE: the netlogon secure channel accepts weak RC4/HMAC-MD5 crypto and unsealed traffic, allowing elevation of privilege - debian/patches/CVE-2022-38023.patch: default 'reject md5 clients' and 'reject md5 servers' to yes, add 'server schannel require seal [:COMPUTERACCOUNT]' (default yes) and route every netr_LogonSamLogon* variant through the schannel check in both netlogon servers - CVE-2022-38023 * SECURITY UPDATE: an AD DC can be forced to issue rc4-hmac Kerberos tickets and session keys even where stronger encryption is available - debian/patches/CVE-2022-37966.patch: announce PA-SUPPORTED-ETYPES, select session keys from the server's supported types and add the 'kdc supported enctypes', 'kdc default domain supportedenctypes' and 'kdc force enable rc4 weak session keys' options - debian/patches/CVE-2022-37966-domain-trust-modify.patch: add 'samba-tool domain trust modify' so an existing RC4-only trust can be repaired - CVE-2022-37966 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: integer overflows in Heimdal PAC parsing allow remote code execution on 32-bit platforms and denial of service elsewhere - debian/patches/CVE-2022-42898.patch: catch the overflows that result from adding PAC_INFO_BUFFER_SIZE when parsing a PAC, and add the 64-bit store/retrieve helpers the checks need - CVE-2022-42898 * SECURITY UPDATE: an AD DC accepts a PAC whose contents were tampered with, because the KDC does not verify a checksum over the whole ticket - debian/patches/CVE-2022-37967.patch: add the new PAC ticket checksum and verify it in the KDC and in the PAC validation paths - CVE-2022-37967 * SECURITY UPDATE: an unprivileged user can write the dNSHostName attribute of a computer account without the Validated-DNS-Host-Name right - debian/patches/CVE-2022-32743.patch: validate dNSHostName and servicePrincipalName writes in the acl module and connect to samdb as the workstation account in the netlogon server - CVE-2022-32743 * SECURITY UPDATE: the netlogon secure channel accepts weak RC4/HMAC-MD5 crypto and unsealed traffic, allowing elevation of privilege - debian/patches/CVE-2022-38023.patch: default 'reject md5 clients' and 'reject md5 servers' to yes, add 'server schannel require seal [:COMPUTERACCOUNT]' (default yes) and route every netr_LogonSamLogon* variant through the schannel check in both netlogon servers - CVE-2022-38023 * SECURITY UPDATE: an AD DC can be forced to issue rc4-hmac Kerberos tickets and session keys even where stronger encryption is available - debian/patches/CVE-2022-37966.patch: announce PA-SUPPORTED-ETYPES, select session keys from the server's supported types and add the 'kdc supported enctypes', 'kdc default domain supportedenctypes' and 'kdc force enable rc4 weak session keys' options - debian/patches/CVE-2022-37966-domain-trust-modify.patch: add 'samba-tool domain trust modify' so an existing RC4-only trust can be repaired - CVE-2022-37966

0 tuxcare-debian11-els ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 3e862a1df5587c80f5a3595e84301d20c9e3b5ba libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 3c3f202c5c653d83ed0093d730574ef96a81953f libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 1c80dda11cf90fad120dd3614358589f19a12797 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 608f30493d7e87117bea3d202a895ab15bd7cdac libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 206300cb6cd5c591d3c69acc128ae7f0bb51f373 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 458ffca8c5398c97182c425c04e2f9a2fe1b29f4 libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 4193e8c524995e9866a8be193b10929c72cf12b7 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb bc1617c1d395d38955eed3910dbecba331168443 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb afb67e8e0c84b16e686500263448368051c9679a samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 87db80cd78569b191f83318462d60039d63c2a08 samba-common_4.13.13+dfsg-1~deb11u8+tuxcare.els3_all.deb 3d80a7a680aa171797c08eb742e76886fc8bab0d samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 536a024a78b89c8903ec07e1881cc8cd9f8e20ac samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 8fe084efc81004543a72b71f844cd497b0405c14 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb bc0fd80f9f84415043cc849dbcf06b7361c0a989 samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 8856a9a0fea24bd3d3187074f53b4029fce9a874 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb e27c4cd409b41607850dcff7e628ad06998323c1 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 89b0aa78695d552701aef76e08738e5952ea8c15 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb e4c6e38545487babdb67849a94b7fce63490710c winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_amd64.deb 87c09b942b98b06348bac12f696b64b0b60c67d4 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb c406754ae6d53de48ec07cf88cd6223bf316ada4 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb ecb0bfc6ee8ca94f7d02d3f75c26c140c8982bac libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb ffa6604a46e6f52d2e6a8bb121b108211a68e495 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 90ac1712233fea855190aa22f291a8a90ac199f7 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 6a2df9c6ff8fa8a5e33aa9c3f0b50f60a8e5d0e9 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb dd9055d855f5d1999c170562c444db5f27ce0803 libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 4eccb31c3b7c6b30ebcbd48f7e762e8a6493dc72 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb d95b47f6939b2466c64f2fcd298ff086fc46f6b3 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 603e9ed0bd01b57743d282df5a00f4bc02eeebc6 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 0d4ee37cad8fc3776250114f6a0e0723309f6dbb samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb b14f9148e69d33853ed988e0e3cdcff8cd3fb1cf samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 32771e00526c95eb70fb1cacde93b23a5f46920f samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 310165e4b239028764d7663a42009287aba991c4 samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb e86fef986e0634a74dc888c6c00449524c48be72 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 785d219f89e4a275d640059d5355ca8a11b80346 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 49507ef090a83531e834c625b5fda061ecbe22ee smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb c9d198271bbf4e4995c0100af6abd867d9b8a76a winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_arm64.deb 39ef6632c1750bf60b4efc0a4fdecc659d9454b5 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 199972966da3bc4171dd066715347a21a272daa0 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 6ada6518965f54fdbcf0d821da37827d061cac31 libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 693b4773052165f3d2102fed265e4c9e9711bab3 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 51a82dafaa66184c4449b4a5143975799dab7ea5 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 80db959ee6beeda2e15b6ba7bd7fcd3885a39898 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb cb381797c6bbe24f777bfba19e7f880d605627ae libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 130f9ca668066e13fea67bf018c123f6febf796d python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb a8ef4d7c9978f9ce809fa9abdda1b0871fbd7489 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb a6f9160e0c5d1608c57ae197b70377ce6b11a120 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 570af298dcd11d2e8678bb4781f2059796788811 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb f21361a0df1da540de5a71f4bfa3fb261102491d samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 9c49c5dbb0bc6dafad67363f2767b369cb619c05 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 7687828b4aee456fdcccc6ff629f1993ebbc6e6c samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb e672642b999fcb61d2d812451fbff4ee4138cea7 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb ddf486199e1e8ae7c17d964d5bb29c67e4be4607 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb e079a83d60503be83218a1cb8f3239f0b292ce21 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb 5c6744076e6cebc7dcf5c11fb42671e3f7253b1b winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els3_armel.deb a0eeeb1f020e0d0ab3532839d26aaaeb111fb212 CLSA-2026:1789581984 TuxCare License Agreement 0 * SECURITY UPDATE: Subject buffer overread in JIT - debian/patches/CVE-2019-20838.patch: skip the fixed-quantifier fast path for \R and \X in pcre_jit_compile.c - CVE-2019-20838 * Stop RunGrepTest failing the armel build - debian/rules: run the rest of the test suite instead of RunGrepTest on armel, where pcregrep's directory recursion returns no entries so the six "-L -r" subtests print an empty file list; pre-existing, the init commit's own build fails identically, and the other five tests still gate the architecture Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Subject buffer overread in JIT - debian/patches/CVE-2019-20838.patch: skip the fixed-quantifier fast path for \R and \X in pcre_jit_compile.c - CVE-2019-20838 * Stop RunGrepTest failing the armel build - debian/rules: run the rest of the test suite instead of RunGrepTest on armel, where pcregrep's directory recursion returns no entries so the six "-L -r" subtests print an empty file list; pre-existing, the init commit's own build fails identically, and the other five tests still gate the architecture

0 tuxcare-debian11-els libpcre16-3_8.39-13+tuxcare.els1_amd64.deb af166039c71cb6ca149016cf8248a8b9d67f70f7 libpcre3_8.39-13+tuxcare.els1_amd64.deb 8cc60fcce46c54cc92990a504ffde98fb181379c libpcre3-dev_8.39-13+tuxcare.els1_amd64.deb 5e0b5b096a4d82ed855d192b3eeffe8503dd3ef5 libpcre32-3_8.39-13+tuxcare.els1_amd64.deb 33aee95c84c585ce0c609d0b0e6374769e0c3f08 libpcrecpp0v5_8.39-13+tuxcare.els1_amd64.deb e6e42cfe24ef5cef11b74e43368794a22db5d2b1 pcregrep_8.39-13+tuxcare.els1_amd64.deb 774a2e87448ebbaec772ee6613f52a0c4554c56a libpcre16-3_8.39-13+tuxcare.els1_arm64.deb 5796dfc48f40b848829b61485e52bd37d35131ec libpcre3_8.39-13+tuxcare.els1_arm64.deb eeda13bad1a9053382acfd394cdd114e4e0fa480 libpcre3-dev_8.39-13+tuxcare.els1_arm64.deb 6126d089a750101dc49ec1bd3ac24fe6c8f72470 libpcre32-3_8.39-13+tuxcare.els1_arm64.deb ef15286a5ec1e0506fffdf12d486ebef585282ac libpcrecpp0v5_8.39-13+tuxcare.els1_arm64.deb 9208320084edc8f7344498d6a8363294d9cab69c pcregrep_8.39-13+tuxcare.els1_arm64.deb 3a7b76c5fa491df9676f4ff2776d114df9a2a511 libpcre16-3_8.39-13+tuxcare.els1_armel.deb 2065cc6b33c001bf68cf33ebba6b29a72df2e392 libpcre3_8.39-13+tuxcare.els1_armel.deb c33531da9e455486d77f4ba0ca43389a566d1554 libpcre3-dev_8.39-13+tuxcare.els1_armel.deb 01637f45eda6b73e49babcc26395a37e16d06dbb libpcre32-3_8.39-13+tuxcare.els1_armel.deb eef0bed46e9f5c1bf4d8abc1f1bc34c09f3ed7f1 libpcrecpp0v5_8.39-13+tuxcare.els1_armel.deb 6010818bb8a34e2852cc843f90d9e0855641d5ee pcregrep_8.39-13+tuxcare.els1_armel.deb 6e89b0ca2b1af632e4aa1a5c03784d43c5464a18 CLSA-2026:1789582390 TuxCare License Agreement 0 * SECURITY UPDATE: Array-bounds overflow in the printf() implementation when a string argument to %q, %Q or %w exceeds 2GB - debian/patches/CVE-2022-35737.patch: widen the i, j, k and n loop variables in sqlite3_str_vappendf() to i64 so the length computation no longer overflows a signed int - CVE-2022-35737 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Array-bounds overflow in the printf() implementation when a string argument to %q, %Q or %w exceeds 2GB - debian/patches/CVE-2022-35737.patch: widen the i, j, k and n loop variables in sqlite3_str_vappendf() to i64 so the length computation no longer overflows a signed int - CVE-2022-35737

0 tuxcare-debian11-els lemon_3.34.1-3+deb11u1+tuxcare.els1_amd64.deb 41060ed84b67b75f082742ee952e89390efb7f29 libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els1_amd64.deb 3df14d2fa442cd59a76e8c66e8cb97095c4ebf1b libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els1_amd64.deb 5fdd60c8b85ece20cf8fce05ba652274205e0557 libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els1_amd64.deb 52b109d22dcfed982a3447fe9c1732b52695c8fd sqlite3_3.34.1-3+deb11u1+tuxcare.els1_amd64.deb fb8913281a2d29dc7df0027840a55c23f6a8b63a sqlite3-doc_3.34.1-3+deb11u1+tuxcare.els1_all.deb b4be7a1e575231052939998d9a5ffc589d4a7a70 lemon_3.34.1-3+deb11u1+tuxcare.els1_arm64.deb d29b0a26bf8c169c5a04f7eaf1a4f23487b97efb libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els1_arm64.deb a072a43622fcc914b442278a53c5a37f971ff0bc libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els1_arm64.deb 9a4a441f91ba6f39175027c557609bb8654d3abf libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els1_arm64.deb 5560e60f6332c1082875119bd0b5dfbcc3779d39 sqlite3_3.34.1-3+deb11u1+tuxcare.els1_arm64.deb 4fcd233c3dbb762c59a733eceba4306109ab70f3 lemon_3.34.1-3+deb11u1+tuxcare.els1_armel.deb 0e2c74f13887338ba5289e4bba7776af62aba439 libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els1_armel.deb 4343a623e5131c84a1e933079a8b13e8b6a59c42 libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els1_armel.deb 0ea2d3d264f84d69214a3dff2f9e4e279afa7664 libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els1_armel.deb 5e6db5c7e07b366b075a8a06a952d005753d7882 sqlite3_3.34.1-3+deb11u1+tuxcare.els1_armel.deb 7ccc506f2225f92b86b292c1133da56fae1f7d3a CLSA-2026:1789635862 TuxCare License Agreement 0 * SECURITY UPDATE: remote arbitrary file write via an unrequested file list - debian/patches/CVE-2022-29154.patch: add the receiver-side admission check (and the argument-escaping rework it needs) so a malicious server cannot write files the client never asked for; taken from Red Hat's rsync-3.2.3 patch pair - the same patch adds upstream's two follow-ups to that rework: 1aef79e1, which stops safe_arg() leaving a trailing backslash unescaped for the remote shell, and 4ad3dbcf, which un-escapes daemon option args since no remote shell does it for a daemon - CVE-2022-29154 * SECURITY UPDATE: rrsync restricted-directory escape - debian/patches/CVE-2026-53783.patch: replace the Perl rrsync with upstream's hardened Python implementation, which inode-pins the validated path, denies --copy-unsafe-links, refuses a symlinked --log-file and passes --drop-D; add the --drop-D option it requires. The shebang is normalised to /usr/bin/python3, keeping the convention debian/patches/perl_shebang.patch sets for the shipped scripts - CVE-2026-53783 * SECURITY UPDATE: command and argument injection via unquoted values - debian/patches/CVE-2026-53790.patch: quote or refuse shell-active values in the RSYNC_CONNECT_PROG host substitution, the daemon exec-hook expansions, rsync-ssl hostspecs and remote-shell arguments - CVE-2026-53790 * SECURITY UPDATE: chroot /./ inner-module escape - debian/patches/CVE-2026-53793.patch: engage the secure resolver for the generator basis stat, the module chdir and the receiver write path, and sanitize the peer-supplied basis name on the client too - CVE-2026-53793 * SECURITY UPDATE: arbitrary file read via symlinked input files - debian/patches/CVE-2026-53802.patch: resolve --filter merge files, --files-from/--include-from/--exclude-from, the daemon secrets file and --password-file through a trusted-owner path walk - CVE-2026-53802 * SECURITY UPDATE: arbitrary file write via symlinked output paths - debian/patches/CVE-2026-53803.patch: same path walk for --log-file, --write-batch/--read-batch and the daemon motd, lock, early-input and --config opens, plus an S_ISREG check on --read-batch - CVE-2026-53803 * SECURITY UPDATE: unauthenticated TLS in rsync-ssl - debian/patches/CVE-2026-70454.patch: validate the helper hostname, require certificate verification and bind the certificate to the requested hostname in stunnel mode, and refuse the GnuTLS backend without a CA certificate; each of the three is opt-out through an environment variable, for deployments that cannot meet it -- see the patch header - CVE-2026-70454 * SECURITY UPDATE: unbounded pre-transfer daemon handshake - debian/patches/CVE-2026-70464.patch: bound the greeting, authentication and argument reads with an absolute deadline so an unauthenticated peer cannot hold a max-connections slot open, and cap the argument count - CVE-2026-70464 * debian/control: suggest python3-braceexpand, which the Python rrsync uses for brace expansion when present * debian/rsync.NEWS: document the rrsync interpreter change for anyone using the script in an authorized_keys forced command Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: remote arbitrary file write via an unrequested file list - debian/patches/CVE-2022-29154.patch: add the receiver-side admission check (and the argument-escaping rework it needs) so a malicious server cannot write files the client never asked for; taken from Red Hat's rsync-3.2.3 patch pair - the same patch adds upstream's two follow-ups to that rework: 1aef79e1, which stops safe_arg() leaving a trailing backslash unescaped for the remote shell, and 4ad3dbcf, which un-escapes daemon option args since no remote shell does it for a daemon - CVE-2022-29154 * SECURITY UPDATE: rrsync restricted-directory escape - debian/patches/CVE-2026-53783.patch: replace the Perl rrsync with upstream's hardened Python implementation, which inode-pins the validated path, denies --copy-unsafe-links, refuses a symlinked --log-file and passes --drop-D; add the --drop-D option it requires. The shebang is normalised to /usr/bin/python3, keeping the convention debian/patches/perl_shebang.patch sets for the shipped scripts - CVE-2026-53783 * SECURITY UPDATE: command and argument injection via unquoted values - debian/patches/CVE-2026-53790.patch: quote or refuse shell-active values in the RSYNC_CONNECT_PROG host substitution, the daemon exec-hook expansions, rsync-ssl hostspecs and remote-shell arguments - CVE-2026-53790 * SECURITY UPDATE: chroot /./ inner-module escape - debian/patches/CVE-2026-53793.patch: engage the secure resolver for the generator basis stat, the module chdir and the receiver write path, and sanitize the peer-supplied basis name on the client too - CVE-2026-53793 * SECURITY UPDATE: arbitrary file read via symlinked input files - debian/patches/CVE-2026-53802.patch: resolve --filter merge files, --files-from/--include-from/--exclude-from, the daemon secrets file and --password-file through a trusted-owner path walk - CVE-2026-53802 * SECURITY UPDATE: arbitrary file write via symlinked output paths - debian/patches/CVE-2026-53803.patch: same path walk for --log-file, --write-batch/--read-batch and the daemon motd, lock, early-input and --config opens, plus an S_ISREG check on --read-batch - CVE-2026-53803 * SECURITY UPDATE: unauthenticated TLS in rsync-ssl - debian/patches/CVE-2026-70454.patch: validate the helper hostname, require certificate verification and bind the certificate to the requested hostname in stunnel mode, and refuse the GnuTLS backend without a CA certificate; each of the three is opt-out through an environment variable, for deployments that cannot meet it -- see the patch header - CVE-2026-70454 * SECURITY UPDATE: unbounded pre-transfer daemon handshake - debian/patches/CVE-2026-70464.patch: bound the greeting, authentication and argument reads with an absolute deadline so an unauthenticated peer cannot hold a max-connections slot open, and cap the argument count - CVE-2026-70464 * debian/control: suggest python3-braceexpand, which the Python rrsync uses for brace expansion when present * debian/rsync.NEWS: document the rrsync interpreter change for anyone using the script in an authorized_keys forced command

0 tuxcare-debian11-els rsync_3.2.3-4+deb11u4+tuxcare.els3_amd64.deb 93f0fb0b0e14243c7b972ed58e680c6173ea9e6a rsync_3.2.3-4+deb11u4+tuxcare.els3_arm64.deb 61cd6609d8669c8074a1bf1e1ee3befbf0956268 rsync_3.2.3-4+deb11u4+tuxcare.els3_armel.deb dc2e54684c1be9c89b7841f1e4206ab6ba4640a4 CLSA-2026:1789639853 TuxCare License Agreement 0 * SECURITY UPDATE: Fix metadata buffer leak in tls-crypt-v2 client key extraction - debian/patches/CVE-2026-12932.patch: make the tls-crypt-v2 metadata a local variable instead of a tls_wrap_ctx member and always free it on every exit path in tls_crypt_v2_extract_client_key - CVE-2026-12932 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Fix metadata buffer leak in tls-crypt-v2 client key extraction - debian/patches/CVE-2026-12932.patch: make the tls-crypt-v2 metadata a local variable instead of a tls_wrap_ctx member and always free it on every exit path in tls_crypt_v2_extract_client_key - CVE-2026-12932

0 tuxcare-debian11-els openvpn_2.5.1-3+deb11u4+tuxcare.els2_amd64.deb 8953e4bd64c9c8da8963bec0785d4939469efe4b openvpn_2.5.1-3+deb11u4+tuxcare.els2_arm64.deb ef5c1395ecd94f9d0a7ff00d7f9997388a16063a openvpn_2.5.1-3+deb11u4+tuxcare.els2_armel.deb 912ec30da2a74bbb2321b56eefbde68dd68c7e32 CLSA-2026:1789639975 TuxCare License Agreement 0 * SECURITY UPDATE: with latin1 encoding CTRL-W might go before the start of the command line - debian/patches/CVE-2022-1619.patch: with latin1 encoding CTRL-W might go before the start of the command line - CVE-2022-1619 * SECURITY UPDATE: using an invalid index when looking for spell suggestions - debian/patches/CVE-2022-2126.patch: using an invalid index when looking for spell suggestions - CVE-2022-2126 * SECURITY UPDATE: reading beyond the end of the line with lisp indenting - debian/patches/CVE-2022-2183.patch: reading beyond the end of the line with lisp indenting - CVE-2022-2183 * SECURITY UPDATE: reading past the end of a string with some completions - debian/patches/CVE-2022-2286.patch: reading past the end of a string with some completions - CVE-2022-2286 * SECURITY UPDATE: reading past the end of a completion with a long line and 'infercase' set - debian/patches/CVE-2022-2343.patch: reading past the end of a completion with a long line and 'infercase' set - CVE-2022-2343 * SECURITY UPDATE: illegal memory access when a pattern starts with an illegal byte - debian/patches/CVE-2022-2581.patch: illegal memory access when a pattern starts with an illegal byte - CVE-2022-2581 * SECURITY UPDATE: using freed memory with an error in an assert argument - debian/patches/CVE-2022-2817.patch: using freed memory with an error in an assert argument - CVE-2022-2817 * SECURITY UPDATE: using freed memory when an autocommand changes a mark - debian/patches/CVE-2022-3256.patch: using freed memory when an autocommand changes a mark - CVE-2022-3256 * SECURITY UPDATE: buffer underflow with an unexpected :finally - debian/patches/CVE-2022-3296.patch: buffer underflow with an unexpected :finally - CVE-2022-3296 * SECURITY UPDATE: missing NULL check on the return value of XChangeGC() - debian/patches/CVE-2022-47024.patch: missing NULL check on the return value of XChangeGC() - CVE-2022-47024 * SECURITY UPDATE: invalid memory access with a bad 'statusline' value - debian/patches/CVE-2023-0049.patch: invalid memory access with a bad 'statusline' value - CVE-2023-0049 * SECURITY UPDATE: buffer overflow in netbeans special_keys() handling - debian/patches/CVE-2026-26269.patch: buffer overflow in netbeans special_keys() handling - CVE-2026-26269 * SECURITY UPDATE: insufficient validation of hostname and port in netrw URIs allows command injection - debian/patches/CVE-2026-28417.patch: insufficient validation of hostname and port in netrw URIs allows command injection - CVE-2026-28417 * SECURITY UPDATE: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - debian/patches/CVE-2026-39881.patch: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - CVE-2026-39881 * SECURITY UPDATE: command injection via backticks in tag files - debian/patches/CVE-2026-41411.patch: command injection via backticks in tag files - CVE-2026-41411 * SECURITY UPDATE: possible code execution with python3complete and pythoncomplete - debian/patches/CVE-2026-52858.patch: possible code execution with python3complete and pythoncomplete - CVE-2026-52858 * SECURITY UPDATE: out-of-bounds read in update_snapshot() with a full combining-character cell - debian/patches/CVE-2026-52859.patch: out-of-bounds read in update_snapshot() with a full combining-character cell - CVE-2026-52859 * SECURITY UPDATE: out-of-bounds write with soundfold() - debian/patches/CVE-2026-57455.patch: out-of-bounds write with soundfold() - CVE-2026-57455 * SECURITY UPDATE: code execution via a crafted .VimballRecord file - debian/patches/CVE-2026-73076.patch: code execution via a crafted .VimballRecord file - CVE-2026-73076 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: with latin1 encoding CTRL-W might go before the start of the command line - debian/patches/CVE-2022-1619.patch: with latin1 encoding CTRL-W might go before the start of the command line - CVE-2022-1619 * SECURITY UPDATE: using an invalid index when looking for spell suggestions - debian/patches/CVE-2022-2126.patch: using an invalid index when looking for spell suggestions - CVE-2022-2126 * SECURITY UPDATE: reading beyond the end of the line with lisp indenting - debian/patches/CVE-2022-2183.patch: reading beyond the end of the line with lisp indenting - CVE-2022-2183 * SECURITY UPDATE: reading past the end of a string with some completions - debian/patches/CVE-2022-2286.patch: reading past the end of a string with some completions - CVE-2022-2286 * SECURITY UPDATE: reading past the end of a completion with a long line and 'infercase' set - debian/patches/CVE-2022-2343.patch: reading past the end of a completion with a long line and 'infercase' set - CVE-2022-2343 * SECURITY UPDATE: illegal memory access when a pattern starts with an illegal byte - debian/patches/CVE-2022-2581.patch: illegal memory access when a pattern starts with an illegal byte - CVE-2022-2581 * SECURITY UPDATE: using freed memory with an error in an assert argument - debian/patches/CVE-2022-2817.patch: using freed memory with an error in an assert argument - CVE-2022-2817 * SECURITY UPDATE: using freed memory when an autocommand changes a mark - debian/patches/CVE-2022-3256.patch: using freed memory when an autocommand changes a mark - CVE-2022-3256 * SECURITY UPDATE: buffer underflow with an unexpected :finally - debian/patches/CVE-2022-3296.patch: buffer underflow with an unexpected :finally - CVE-2022-3296 * SECURITY UPDATE: missing NULL check on the return value of XChangeGC() - debian/patches/CVE-2022-47024.patch: missing NULL check on the return value of XChangeGC() - CVE-2022-47024 * SECURITY UPDATE: invalid memory access with a bad 'statusline' value - debian/patches/CVE-2023-0049.patch: invalid memory access with a bad 'statusline' value - CVE-2023-0049 * SECURITY UPDATE: buffer overflow in netbeans special_keys() handling - debian/patches/CVE-2026-26269.patch: buffer overflow in netbeans special_keys() handling - CVE-2026-26269 * SECURITY UPDATE: insufficient validation of hostname and port in netrw URIs allows command injection - debian/patches/CVE-2026-28417.patch: insufficient validation of hostname and port in netrw URIs allows command injection - CVE-2026-28417 * SECURITY UPDATE: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - debian/patches/CVE-2026-39881.patch: netbeans defineAnnoType and specialKeys pass unvalidated names into Ex commands, allowing command injection - CVE-2026-39881 * SECURITY UPDATE: command injection via backticks in tag files - debian/patches/CVE-2026-41411.patch: command injection via backticks in tag files - CVE-2026-41411 * SECURITY UPDATE: possible code execution with python3complete and pythoncomplete - debian/patches/CVE-2026-52858.patch: possible code execution with python3complete and pythoncomplete - CVE-2026-52858 * SECURITY UPDATE: out-of-bounds read in update_snapshot() with a full combining-character cell - debian/patches/CVE-2026-52859.patch: out-of-bounds read in update_snapshot() with a full combining-character cell - CVE-2026-52859 * SECURITY UPDATE: out-of-bounds write with soundfold() - debian/patches/CVE-2026-57455.patch: out-of-bounds write with soundfold() - CVE-2026-57455 * SECURITY UPDATE: code execution via a crafted .VimballRecord file - debian/patches/CVE-2026-73076.patch: code execution via a crafted .VimballRecord file - CVE-2026-73076

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb d2e821e2307768f85f4091272f5f7c3df46364a8 vim-athena_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb 4157aa7476cb73780d9eade89521726c22ae9612 vim-common_8.2.2434-3+deb11u3+tuxcare.els11_all.deb 63abac974762cccd9ae4fb52242b688d8915f62c vim-doc_8.2.2434-3+deb11u3+tuxcare.els11_all.deb db5970c16ad72fdeb25d1d15182bbb27df8aa263 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els11_all.deb 7e611393689506ee852ef580044494d353857c81 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb 1761724b65273b840d6f4d840a5a94bf75629528 vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els11_all.deb 89b6da832ca02dbde41a077834eb37781e9e0afb vim-nox_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb c7addd609805665eb8c2b006b84f44ed1cd7a503 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els11_all.deb 091a0b3ec76b7d8c1abcd880be0b20f1d1c62a6c vim-tiny_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb 5eb4ed40afc8a50b5f1c0f6e6ff353eaece3088c xxd_8.2.2434-3+deb11u3+tuxcare.els11_amd64.deb ac293cfa105969d2241acb2d2ab10c5efd3ebaf1 vim_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb 3d8cecf44133208f6f82dfa43f9d84ee84a24c70 vim-athena_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb 8f45b8435d38f9fa6d901450fcfcf68d51ffc31b vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb 717a9374b0b6e23a01a923ef458d5e6bed63700a vim-nox_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb 8af2edd3cd6fa6501e71bdd97732ac13cc54695a vim-tiny_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb 28814bc781429015b3b268dbc635029630182762 xxd_8.2.2434-3+deb11u3+tuxcare.els11_arm64.deb c8747ddf02fb7efa98c1a42465663cbc77885efb vim_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb 62281f576b9aafbe064b63698c4eee2cd92bd619 vim-athena_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb 5ae96f2155da2a7784e1c82921383d0230446a55 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb 42753d84346c575c9d918b794c1ac45e5edb86c2 vim-nox_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb 6256e7a2b4b607f1400df2ead038af717b0bb097 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb befbf15ecdea425ce309e712037595d574c1df5d xxd_8.2.2434-3+deb11u3+tuxcare.els11_armel.deb 1e69c1bbd3fa8c3569be8a7fc61b488d4d4b260b CLSA-2026:1789641466 TuxCare License Agreement 0 * SECURITY UPDATE: avoid buffering the whole DTLS read buffer for a record arriving early for the next epoch (ssl/record/rec_layer_d1.c) - debian/patches/CVE-2026-54874.patch: dtls1_buffer_record() took over the entire live read buffer for every queued record and allocated a fresh one, pinning about 16.7 KB of heap per queued record however small the record actually was, across three queues capped at 100 entries each; copy only the record's own on-wire bytes into a right-sized allocation and restore them into the live read buffer on retrieval, in ssl/record/rec_layer_d1.c, ssl/record/record.h and ssl/record/ssl3_record.c - CVE-2026-54874 * Stop 30-test_afalg.t failing the armel build - debian/rules: exclude that one test recipe on armel, where the builder's io_setup(2) is not implemented so the AF_ALG engine cannot be exercised; the engine is still built and shipped and every other architecture still runs the test Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: avoid buffering the whole DTLS read buffer for a record arriving early for the next epoch (ssl/record/rec_layer_d1.c) - debian/patches/CVE-2026-54874.patch: dtls1_buffer_record() took over the entire live read buffer for every queued record and allocated a fresh one, pinning about 16.7 KB of heap per queued record however small the record actually was, across three queues capped at 100 entries each; copy only the record's own on-wire bytes into a right-sized allocation and restore them into the live read buffer on retrieval, in ssl/record/rec_layer_d1.c, ssl/record/record.h and ssl/record/ssl3_record.c - CVE-2026-54874 * Stop 30-test_afalg.t failing the armel build - debian/rules: exclude that one test recipe on armel, where the builder's io_setup(2) is not implemented so the AF_ALG engine cannot be exercised; the engine is still built and shipped and every other architecture still runs the test

0 tuxcare-debian11-els libssl-dev_1.1.1w-0+deb11u8+tuxcare.els1_amd64.deb 1c0a418d60af9624bf6cb69caa346037ba8be687 libssl-doc_1.1.1w-0+deb11u8+tuxcare.els1_all.deb 269b3ce5f25a14228c929e9d0971fc055c77443c libssl1.1_1.1.1w-0+deb11u8+tuxcare.els1_amd64.deb 1fd6c343ac65e2f70f5d4d1267bc6040a32d80ec openssl_1.1.1w-0+deb11u8+tuxcare.els1_amd64.deb 0cf0cbd4182c566101f95106d9b906ced67c72ce libssl-dev_1.1.1w-0+deb11u8+tuxcare.els1_arm64.deb 0f42c8145d2b9f8bb57ef59d1e6fd1c4beb5c7de libssl1.1_1.1.1w-0+deb11u8+tuxcare.els1_arm64.deb 2af9ea86d1fe2062570d10e4687239c27163d93e openssl_1.1.1w-0+deb11u8+tuxcare.els1_arm64.deb dffcbc8961084131db3d383eefcf56d55e565ed7 libssl-dev_1.1.1w-0+deb11u8+tuxcare.els1_armel.deb 12eab2d409d4c7745bbf267cfb6b3d2872daa323 libssl1.1_1.1.1w-0+deb11u8+tuxcare.els1_armel.deb aad267468797de1a99e791b37788d8c2464a944b openssl_1.1.1w-0+deb11u8+tuxcare.els1_armel.deb 523271dbb82b029c2fb9625b069e2013839cb164 CLSA-2026:1789643272 TuxCare License Agreement 0 * SECURITY UPDATE: Negative message length in imptcp regex framing - debian/patches/CVE-2026-19654.patch: accept a regex framing match only when it follows an existing line, and fix the oversize regression test helper invocations - CVE-2026-19654 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Negative message length in imptcp regex framing - debian/patches/CVE-2026-19654.patch: accept a regex framing match only when it follows an existing line, and fix the oversize regression test helper invocations - CVE-2026-19654

0 tuxcare-debian11-els rsyslog_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb d7dc466f03e4bf830651dddb1838ca64980460bf rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 75d72caff079bb547a46dfa985225e182c19f5ad rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb f89d19a312cab9fe6bf0398a59eb6de465b396fb rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 9a642075067731649415c3fe7e8fa52999a325d3 rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb e40fc82bb5ddccc38e74857a753829d5a4cc8012 rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 0db6f78e98830259e8d50154c3a61e59920075d9 rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 9bcf4e94b6a009f1f9138290d80e23df32e98456 rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 417b1646f5b5ec8ada5214f83d3e7454c5b96c02 rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb 3debf622bc15d54ca4a420051f529e4835eb39e4 rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb f088aac267e58a16a4d9ae45ac4d95e1e3ccc8f3 rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb cc80ae6babef6e37446c202617bc361d7f026d63 rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els1_amd64.deb d32ebfb309629cee3dd5297b86925dbc4333e37b rsyslog_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 8b1c3abe1339ad6ff4fce56bb8eb8a0b1cf8b09a rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb b8eb8ff1ffb50403c4ca4c2a3f0c28eaaba8709a rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 81cb53a9b61addae32e5d74aaf9698ec5020f65e rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 1e023380b590d61f799b2d80d0038e8d73586054 rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 54b78c139c3f31fa42d7b1463700bd6973b0155a rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 3971bc34f0a21db1ec9e4332706eb59c4d36356a rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 28c589b5fcfaef6063b24f5c8951792608923012 rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb cb5ca90a31768790d675e47f7715e6d17681db8e rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 5ce496145e953b5549d8a964395446537a236560 rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb d443fbdc892913ce0b91588ec6cc1446854cf9f7 rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 28b4e0f19d4be53dbad3fe237345d2611fd9965a rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els1_arm64.deb 5269fe937f373e19751e2b99064758840d778ba2 rsyslog_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 940bd83ceb9178476dd872fd882276985070f137 rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb e01653accc7a603e967231fd3fdf4f6f6a4b0359 rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb d5a819ff2d3d4dac158c15844fc5fbce45a62a8f rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb fb4117949e3cbae07be886484d7d807737a4b2b4 rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb aad57d702386c9af28a517a35c71b1bb7cfde2a2 rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 36f9129c96838476a4ddf1d3a9f6a5cb3b14b607 rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 85836f78f2d289eb1b93494b9e3802084a7f7f63 rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 52aac4e556e8dbfe456c9b3afd6bba3b74e6f685 rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 6bd32d3c74ed6e082f77b520e27ab08f9d83b9fa rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 9ec1b2da9b711e2d7dbba6753516146861444276 rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 007a4357010475c6271c3c4ab06795f742f9f58d rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els1_armel.deb 1b8b8337be199366d1ab120aa27d4def38976865 CLSA-2026:1789661255 TuxCare License Agreement 0 * SECURITY UPDATE: integer overflow in new_x_NC_var() and unbounded ndims in v1h_get_NC_var() (CVE-2025-14933) * SECURITY UPDATE: stack buffer overflow in NC3_inq_var() (CVE-2025-14934) * SECURITY UPDATE: heap buffer overflow in NC3_inq_dim() (CVE-2025-14935) * SECURITY UPDATE: stack buffer overflow in NC3_inq_attname() (CVE-2025-14936) Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: integer overflow in new_x_NC_var() and unbounded ndims in v1h_get_NC_var() (CVE-2025-14933) * SECURITY UPDATE: stack buffer overflow in NC3_inq_var() (CVE-2025-14934) * SECURITY UPDATE: heap buffer overflow in NC3_inq_dim() (CVE-2025-14935) * SECURITY UPDATE: stack buffer overflow in NC3_inq_attname() (CVE-2025-14936)

0 tuxcare-debian11-els libnetcdf-dev_4.7.4-1+tuxcare.els1_amd64.deb 26084fdd48b16d0efcc19f7756e0738f7741a85d libnetcdf18_4.7.4-1+tuxcare.els1_amd64.deb 69e7ade68f0aef72635595e1b0f5616b7ca4eae2 netcdf-bin_4.7.4-1+tuxcare.els1_amd64.deb 8d8d6145136edda4425b0d74635e7f18a9a3a367 netcdf-doc_4.7.4-1+tuxcare.els1_all.deb b597dac6db97396c121efc58c89aa54dacb4df53 libnetcdf-dev_4.7.4-1+tuxcare.els1_arm64.deb b1ac03fd8a57300a174b7df3d0427aa91ebef46d libnetcdf18_4.7.4-1+tuxcare.els1_arm64.deb ed2a32e45a9979ebb94f390adc95db0f875de79e netcdf-bin_4.7.4-1+tuxcare.els1_arm64.deb 0880a65b3d17e1bd29588d2aca79e908786a1575 libnetcdf-dev_4.7.4-1+tuxcare.els1_armel.deb 8b958f5f0b8ce8e296c2da23dde435ad0384958e libnetcdf18_4.7.4-1+tuxcare.els1_armel.deb e1f486989f26b4dfcb01ce86d88316b16a1ee8c3 netcdf-bin_4.7.4-1+tuxcare.els1_armel.deb 36ed6efa95465eacb518fff4ed700ce27bcf1041 CLSA-2026:1789666971 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds write in pcre2_dfa_match() because more_workspace() reused a cached recursive-DFA workspace block without checking it was large enough for the request, so a pattern using nested assertions followed by recursion under a small heap limit could overflow the heap allocation (PCRE2 before 10.48) - debian/patches/CVE-2026-86145.patch: reject a cached next block smaller than the requested size, and clamp a newly allocated block to the remaining heap allowance without overflowing the size computation, in more_workspace() in src/pcre2_dfa_match.c - CVE-2026-86145 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds write in pcre2_dfa_match() because more_workspace() reused a cached recursive-DFA workspace block without checking it was large enough for the request, so a pattern using nested assertions followed by recursion under a small heap limit could overflow the heap allocation (PCRE2 before 10.48) - debian/patches/CVE-2026-86145.patch: reject a cached next block smaller than the requested size, and clamp a newly allocated block to the remaining heap allowance without overflowing the size computation, in more_workspace() in src/pcre2_dfa_match.c - CVE-2026-86145

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els2_amd64.deb feb60bf4bb42529e923632a5e0726a79c94befc9 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els2_amd64.deb 43881bb202f7b31e04f92eec3993f4f26c5a7c1e libpcre2-8-0_10.36-2+deb11u1+tuxcare.els2_amd64.deb 5a9d4ba90092b479ac55eaebb508def813529b7d libpcre2-dev_10.36-2+deb11u1+tuxcare.els2_amd64.deb eeb9dcc8c40ffc7741de82a3726508aaa29da717 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els2_amd64.deb 2f62c4bc9127668dd2c2ab0714a164503d763e50 pcre2-utils_10.36-2+deb11u1+tuxcare.els2_amd64.deb 26fba85ad45aed2d33e8b0162d4cccd51fa64521 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els2_arm64.deb cb0f07e719f42f3ef17f707fc8d0b76156d932dd libpcre2-32-0_10.36-2+deb11u1+tuxcare.els2_arm64.deb 4fa679bc0b825199122a2ff2dac9e69bc4371500 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els2_arm64.deb 8112fb2e8c3220db100b8b8a7d844ded1e163388 libpcre2-dev_10.36-2+deb11u1+tuxcare.els2_arm64.deb eb9fa9fe1d9814dc2cd2a9ade5766f661daff9a4 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els2_arm64.deb 65070b9a5e09eaa866f7c510e2d0ce97f57a1a10 pcre2-utils_10.36-2+deb11u1+tuxcare.els2_arm64.deb 9796441775cddd12762d1df636c52b29ea77ac9f libpcre2-16-0_10.36-2+deb11u1+tuxcare.els2_armel.deb ac3dc47873efee94f7ecf9e8c4d4d119ca902bd4 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els2_armel.deb 1571d8ddad1720c1d9c7cb52862fb9f755e0abb9 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els2_armel.deb acf015ff986cd4d7c073b0051440a5bf58523a18 libpcre2-dev_10.36-2+deb11u1+tuxcare.els2_armel.deb 7d98ac6c565fed640ec3e66355e5068242300d1d libpcre2-posix2_10.36-2+deb11u1+tuxcare.els2_armel.deb 94a69faa5e1a65f4446bada886eacc95e99b17c7 pcre2-utils_10.36-2+deb11u1+tuxcare.els2_armel.deb 8e1b074e2c03598ad67a57ee5d60a6e52d702754 CLSA-2026:1789671837 TuxCare License Agreement 0 * SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER decoding - debian/patches/CVE-2026-59885.patch: accumulate arcs in a list instead of repeated tuple concatenation in the BER decoder and encoder - CVE-2026-59885 * SECURITY UPDATE: Uncontrolled resource consumption converting univ.Real - debian/patches/CVE-2026-59886.patch: use math.ldexp for base 2 and reject base-10 exponents above sys.float_info.max_10_exp in Real.__float__, instead of exact big-integer exponentiation - CVE-2026-59886 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Quadratic complexity in OBJECT IDENTIFIER decoding - debian/patches/CVE-2026-59885.patch: accumulate arcs in a list instead of repeated tuple concatenation in the BER decoder and encoder - CVE-2026-59885 * SECURITY UPDATE: Uncontrolled resource consumption converting univ.Real - debian/patches/CVE-2026-59886.patch: use math.ldexp for base 2 and reject base-10 exponents above sys.float_info.max_10_exp in Real.__float__, instead of exact big-integer exponentiation - CVE-2026-59886

0 tuxcare-debian11-els pypy-pyasn1_0.4.8-1+deb11u2+tuxcare.els1_all.deb 017ca97cdb0a4e94cbf6b5c40aca36448989c57c python-pyasn1-doc_0.4.8-1+deb11u2+tuxcare.els1_all.deb f16abd8e63ca26e0cd16004c9ec49ee2c649e436 python3-pyasn1_0.4.8-1+deb11u2+tuxcare.els1_all.deb 49f6bd8be290817fbc7acfc6e0f19b79e8d6a5c2 CLSA-2026:1789718965 TuxCare License Agreement 0 * SECURITY UPDATE: Buffer overflow in Perl_study_chunk via regex with large repeat counts on multi-character strings - debian/patches/CVE-2026-8376.patch: guard the repeated fixed string buffer size against SSize_t overflow in regcomp.c - upstream's companion test cases are not carried: they assert "Regexp out of space", but 5.32.1 still has REG_INFTY == U16_MAX so the patterns are rejected earlier by the quantifier parser, and the cases are only skipped when ptrsize != 4 so they would run and fail on armel - CVE-2026-8376 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Buffer overflow in Perl_study_chunk via regex with large repeat counts on multi-character strings - debian/patches/CVE-2026-8376.patch: guard the repeated fixed string buffer size against SSize_t overflow in regcomp.c - upstream's companion test cases are not carried: they assert "Regexp out of space", but 5.32.1 still has REG_INFTY == U16_MAX so the patterns are rejected earlier by the quantifier parser, and the cases are only skipped when ptrsize != 4 so they would run and fail on armel - CVE-2026-8376

0 tuxcare-debian11-els libperl-dev_5.32.1-4+deb11u5+tuxcare.els5_amd64.deb 5fb77164fcc26bf4975f40280c7ed004013214b8 libperl5.32_5.32.1-4+deb11u5+tuxcare.els5_amd64.deb 0dac2560d8f2ebf2e878e12403f77a5e25d8b9dd perl_5.32.1-4+deb11u5+tuxcare.els5_amd64.deb 1cb7f47c6e23019a97568d2b122e918e02d4d1df perl-base_5.32.1-4+deb11u5+tuxcare.els5_amd64.deb f709eb789b3de780ddabfd84b64183c3d0454a71 perl-debug_5.32.1-4+deb11u5+tuxcare.els5_amd64.deb ee5f00c859dfa571285ed0b7b55aa723bc4f96a4 perl-doc_5.32.1-4+deb11u5+tuxcare.els5_all.deb eafa49e54b8b948c2c1003050e3e2e42795f3c35 perl-modules-5.32_5.32.1-4+deb11u5+tuxcare.els5_all.deb 22aa9fe97564ab95dce3cad67dbb9c7e3f17fc7e libperl-dev_5.32.1-4+deb11u5+tuxcare.els5_arm64.deb 41102d071db4d46dbc58b840b96632bdb3138036 libperl5.32_5.32.1-4+deb11u5+tuxcare.els5_arm64.deb 568b7764ad1c6ce7fc0b8fed66f4b0c431a91abc perl_5.32.1-4+deb11u5+tuxcare.els5_arm64.deb 3ccdd61a9459b9c61d972848b80c098ab8eec514 perl-base_5.32.1-4+deb11u5+tuxcare.els5_arm64.deb 5d78449aa2544af865b8e0d6e9dad5dd2afba40c perl-debug_5.32.1-4+deb11u5+tuxcare.els5_arm64.deb 9b86fe2a9f44bc96130fff7ff89298a66e4824d5 libperl-dev_5.32.1-4+deb11u5+tuxcare.els5_armel.deb 65df758d7a5e5e6ec33bfc82025cd0f9cf060522 libperl5.32_5.32.1-4+deb11u5+tuxcare.els5_armel.deb 3b1a565cfe2470d8e4f6bdbcf51c1069d9d116bb perl_5.32.1-4+deb11u5+tuxcare.els5_armel.deb 0612fde463cc4503d3881aa6564e57ecd5f56776 perl-base_5.32.1-4+deb11u5+tuxcare.els5_armel.deb 7487a4e5181e6c623c54d518a49a86712e5867c8 perl-debug_5.32.1-4+deb11u5+tuxcare.els5_armel.deb e930c2811a4184c2bd8f902838dbc47993b0983d CLSA-2026:1789719259 TuxCare License Agreement 0 * SECURITY UPDATE: denial of service when seeking a tar stream - debian/patches/CVE-2026-11972.patch: break out of the block-read loop in _Stream.seek() in Lib/tarfile.py once read() returns no data, so a member header declaring a huge size no longer drives an unbounded read loop past end of stream - CVE-2026-11972 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: denial of service when seeking a tar stream - debian/patches/CVE-2026-11972.patch: break out of the block-read loop in _Stream.seek() in Lib/tarfile.py once read() returns no data, so a member header declaring a huge size no longer drives an unbounded read loop past end of stream - CVE-2026-11972

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els2_all.deb 8d7c63992f41d0387a64547dd24804f2e901e59c libpython2.7_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb df5d111801b23db5640e0fb3db2aa778bd69d12b libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb f595da75c71bdc990944dcc7aa1b9082a3278fcd libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb f83dce53ebb7d41baa83634c37198160f3d9981f libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb b8ac0f682ec4ae55eab7717a44d3a390da673fb7 libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els2_all.deb ce3ab72753c2141c6742f405a5a90ec945f32a4f python2.7_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb 52f83e8237c829d7c586084a6653459aec2e681f python2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb 958ff5e14739a2dcc5ebe19c51ebdba7ff296ab5 python2.7-doc_2.7.18-8+deb11u1+tuxcare.els2_all.deb ca81beaa955b56ac42fa9784f83f5296a6e138b0 python2.7-examples_2.7.18-8+deb11u1+tuxcare.els2_all.deb bb6289ec08aca21a152f302b7c93a9d7a2fb37fb python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_amd64.deb 10d8068518bea3f56bf0055f8313ea322c9ce6b4 libpython2.7_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb 605b5844f850cf766bd419cc928cf2318de4f65f libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb fc09b08a1ba53b19073c564c0115fd4de1b46b26 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb 73c3a4ac7284a8f3a4f78184543b0beca56c0e2c libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb 66594d7020cfb3a250c001ccc50e882a096a7623 python2.7_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb 7c3bd6aaed6167f230a604d4feb377fe5e5b5a74 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb 7aa888e4ce7715908076cee0868d168fa3e567a9 python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_arm64.deb f972d4775978212744c08fa70417c84a61cb6ed7 libpython2.7_2.7.18-8+deb11u1+tuxcare.els2_armel.deb fcb99b1d1d28690909c2ad8050c4f072ca8b60bd libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 61010acf5ef7b987018bc502ca08a0f39f799998 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 50df8b8cb52b9af6b8cfc90fdf55611bdfcda943 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 5cf6f84ec55c4752cc2608cbd3def8bf5d17098b python2.7_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 236ccee809b7fc1e0a942e476c5025fdfa4ffcf8 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 62cdab749d415a7b02c6980db192969d2fa0c5ee python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els2_armel.deb 5f11837ba97594637219171b680814bdd9230da1 CLSA-2026:1789728065 TuxCare License Agreement 0 * SECURITY UPDATE: CPU exhaustion from a crafted chain of equal weak checksums - debian/patches/CVE-2026-70453.patch: bound the number of same-weak-checksum candidates hash_search() examines per file offset, so a degenerate chain cannot turn the inner loop into an O(file_size * chain_length) scan - CVE-2026-70453 * SECURITY UPDATE: heap out-of-bounds write in read_args() - debian/patches/CVE-2026-70456.patch: reserve room for the trailing NULL before storing it, so a peer argument count landing exactly on the argv allocation cannot write one pointer past the end - CVE-2026-70456 * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT defeats the client's timeout - debian/patches/CVE-2026-70462.patch: reject a non-positive value, cap the peer's value at 24 hours, and make set_io_timeout() arithmetic overflow-safe so a large value cannot wrap allowed_lull negative - CVE-2026-70462 * SECURITY UPDATE: authorization bypass in the "auth users" parser - debian/patches/CVE-2026-70463.patch: parse with conf_strtok so a leading comma splits on commas alone, and a deny or :ro rule naming a group whose name contains a space fires as written - CVE-2026-70463 * SECURITY UPDATE: wild-pointer read in the per-connection daemon child - debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry, and require dir_flist to hold an entry before trusting parent_ndx 0 - CVE-2026-70459 * SECURITY UPDATE: out-of-bounds write from a peer-set FLAG_HLINKED - debian/patches/CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories, so a peer cannot set it while -H is off and have HLINK_BUMP() displace F_SUM() past the extras - the same patch carries upstream aed77143, which closes a separate unassigned out-of-bounds read of that field: start_server() now sets sender_keeps_checksum for a daemon sender using -c with a %C log format, and hard_link_check() requires S_ISREG before the basis compare - CVE-2026-70458 * SECURITY UPDATE: the per-allocation size cap could be switched off - debian/patches/CVE-2026-53794.patch: reject --max-alloc=0, which disabled the cap that is the defence behind CVE-2024-12084 and was forwarded on the wire; the rsync.1 text describing 0 as "no limit" is corrected with it - a value of 0 is now an error rather than "no limit"; see debian/rsync.NEWS - CVE-2026-53794 * SECURITY UPDATE: implied-parent creation escapes the destination tree - debian/patches/CVE-2026-53785.patch: create each component of make_path() through the held-directory-fd primitive, so a planted parent symlink under --relative cannot place the new directories outside the tree - CVE-2026-53785 * SECURITY UPDATE: source address spoofing via the PROXY protocol header - debian/patches/CVE-2026-53791.patch: add the "proxy protocol hosts" global and honour a forwarded address only when the direct socket peer matches it, so a client connecting directly cannot forge its address past hosts allow - "proxy protocol = true" with no "proxy protocol hosts" now refuses every connection and warns at startup, which is upstream's fail-closed default; see debian/rsync.NEWS - CVE-2026-53791 * SECURITY UPDATE: client-supplied --filter merge file bypasses the module filter - debian/patches/CVE-2026-53786.patch: strip the module-dir prefix, when it is actually present, before checking the merge file against the daemon filter list, and treat a filtered file as absent rather than a fatal error - CVE-2026-53786 * SECURITY UPDATE: absolute --temp-dir or --link-dest disables rename confinement - debian/patches/CVE-2026-53795.patch: confine each side of do_rename_at() and do_link_at() independently, so an absolute path on one side no longer drops the other side back to the unconfined call - CVE-2026-53795 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: CPU exhaustion from a crafted chain of equal weak checksums - debian/patches/CVE-2026-70453.patch: bound the number of same-weak-checksum candidates hash_search() examines per file offset, so a degenerate chain cannot turn the inner loop into an O(file_size * chain_length) scan - CVE-2026-70453 * SECURITY UPDATE: heap out-of-bounds write in read_args() - debian/patches/CVE-2026-70456.patch: reserve room for the trailing NULL before storing it, so a peer argument count landing exactly on the argv allocation cannot write one pointer past the end - CVE-2026-70456 * SECURITY UPDATE: peer-supplied MSG_IO_TIMEOUT defeats the client's timeout - debian/patches/CVE-2026-70462.patch: reject a non-positive value, cap the peer's value at 24 hours, and make set_io_timeout() arithmetic overflow-safe so a large value cannot wrap allowed_lull negative - CVE-2026-70462 * SECURITY UPDATE: authorization bypass in the "auth users" parser - debian/patches/CVE-2026-70463.patch: parse with conf_strtok so a leading comma splits on commas alone, and a deny or :ro rule naming a group whose name contains a space fires as written - CVE-2026-70463 * SECURITY UPDATE: wild-pointer read in the per-connection daemon child - debian/patches/CVE-2026-70459.patch: reject a non-directory transfer-root entry, and require dir_flist to hold an entry before trusting parent_ndx 0 - CVE-2026-70459 * SECURITY UPDATE: out-of-bounds write from a peer-set FLAG_HLINKED - debian/patches/CVE-2026-70458.patch: gate FLAG_HLINKED on preserve_hard_links and exclude directories, so a peer cannot set it while -H is off and have HLINK_BUMP() displace F_SUM() past the extras - the same patch carries upstream aed77143, which closes a separate unassigned out-of-bounds read of that field: start_server() now sets sender_keeps_checksum for a daemon sender using -c with a %C log format, and hard_link_check() requires S_ISREG before the basis compare - CVE-2026-70458 * SECURITY UPDATE: the per-allocation size cap could be switched off - debian/patches/CVE-2026-53794.patch: reject --max-alloc=0, which disabled the cap that is the defence behind CVE-2024-12084 and was forwarded on the wire; the rsync.1 text describing 0 as "no limit" is corrected with it - a value of 0 is now an error rather than "no limit"; see debian/rsync.NEWS - CVE-2026-53794 * SECURITY UPDATE: implied-parent creation escapes the destination tree - debian/patches/CVE-2026-53785.patch: create each component of make_path() through the held-directory-fd primitive, so a planted parent symlink under --relative cannot place the new directories outside the tree - CVE-2026-53785 * SECURITY UPDATE: source address spoofing via the PROXY protocol header - debian/patches/CVE-2026-53791.patch: add the "proxy protocol hosts" global and honour a forwarded address only when the direct socket peer matches it, so a client connecting directly cannot forge its address past hosts allow - "proxy protocol = true" with no "proxy protocol hosts" now refuses every connection and warns at startup, which is upstream's fail-closed default; see debian/rsync.NEWS - CVE-2026-53791 * SECURITY UPDATE: client-supplied --filter merge file bypasses the module filter - debian/patches/CVE-2026-53786.patch: strip the module-dir prefix, when it is actually present, before checking the merge file against the daemon filter list, and treat a filtered file as absent rather than a fatal error - CVE-2026-53786 * SECURITY UPDATE: absolute --temp-dir or --link-dest disables rename confinement - debian/patches/CVE-2026-53795.patch: confine each side of do_rename_at() and do_link_at() independently, so an absolute path on one side no longer drops the other side back to the unconfined call - CVE-2026-53795

0 tuxcare-debian11-els rsync_3.2.3-4+deb11u4+tuxcare.els4_amd64.deb 0df74df40477a885d80a6b9cdcfd61592a1a3d6d rsync_3.2.3-4+deb11u4+tuxcare.els4_arm64.deb 0c3882e3548479b5933b00d378afaa0c7ca277f5 rsync_3.2.3-4+deb11u4+tuxcare.els4_armel.deb 449585e059d7fff11fab18fdcd2c8e8fc1ac5ead CLSA-2026:1789745566 TuxCare License Agreement 0 * SECURITY UPDATE: Integer overflow in the allocation size computation of pcre2_pattern_convert() and pcre2_substring_get_bynumber() leading to an undersized buffer and an out-of-bounds heap write, because both sites multiplied the code-unit count by the code-unit BIT width rather than its byte width and never checked the product for wraparound; reachable with a large pattern or captured substring on 32-bit platforms - debian/patches/CVE-2026-89157.patch: size both allocations with CU2BYTES() and reject a code-unit count that would overflow sizeof(pcre2_memctl) + CU2BYTES(n + 1), in src/pcre2_convert.c and src/pcre2_substring.c - CVE-2026-89157 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Integer overflow in the allocation size computation of pcre2_pattern_convert() and pcre2_substring_get_bynumber() leading to an undersized buffer and an out-of-bounds heap write, because both sites multiplied the code-unit count by the code-unit BIT width rather than its byte width and never checked the product for wraparound; reachable with a large pattern or captured substring on 32-bit platforms - debian/patches/CVE-2026-89157.patch: size both allocations with CU2BYTES() and reject a code-unit count that would overflow sizeof(pcre2_memctl) + CU2BYTES(n + 1), in src/pcre2_convert.c and src/pcre2_substring.c - CVE-2026-89157

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els3_amd64.deb 77a9cec65db3b12769a4b847b9c114a4bde5fe5c libpcre2-32-0_10.36-2+deb11u1+tuxcare.els3_amd64.deb 9055f09a23518bbafebdc6a8013e4a5eb3a35363 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els3_amd64.deb 5b4c68eb2c97d019e9fad889bfcf1610f0a93f7e libpcre2-dev_10.36-2+deb11u1+tuxcare.els3_amd64.deb 2d77835f2d4328af739d1d5e7e4f1e874307bcf8 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els3_amd64.deb 6afe19892b5b724e6dd9cfbf8ce59b0aabc40c66 pcre2-utils_10.36-2+deb11u1+tuxcare.els3_amd64.deb d267465b0708ddb742bb2e294556fdc7a64221d0 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els3_arm64.deb 05aec9cf0a3462e1dd99949281728ba6c4903709 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els3_arm64.deb 75ec7cc6448e00cb841f031ac063c551792f914c libpcre2-8-0_10.36-2+deb11u1+tuxcare.els3_arm64.deb 16ec9351cc3a1fa646f77786ae3d4f61b004909c libpcre2-dev_10.36-2+deb11u1+tuxcare.els3_arm64.deb 39c05e56516e10cd01941cc21067b68db809aabc libpcre2-posix2_10.36-2+deb11u1+tuxcare.els3_arm64.deb fc20023d33287b1ac49a3a68aa57b6b0fc0d180c pcre2-utils_10.36-2+deb11u1+tuxcare.els3_arm64.deb 2a5d69d2d7ffbd8980ca7ed7b4ab4aa9194328df libpcre2-16-0_10.36-2+deb11u1+tuxcare.els3_armel.deb b246e2d074e95aa9b49d90f93533b843d06a26d5 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els3_armel.deb 58e75aa44493552934eb8dc365ac298ba639a8f3 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els3_armel.deb 33606886840d1f71e7e8a25945a1a1e1e7d1f184 libpcre2-dev_10.36-2+deb11u1+tuxcare.els3_armel.deb 3ed0972e77f4caa90f400e4f859a67e4d9c05ec4 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els3_armel.deb 17c892b9bc13b33045812770905b15b4b70597cb pcre2-utils_10.36-2+deb11u1+tuxcare.els3_armel.deb 83d62c631daffa373c163e4f1052fff4263d3a37 CLSA-2026:1789748107 TuxCare License Agreement 0 * Fix the armel build: enable large-file support - debian/rules: build with DEB_BUILD_MAINT_OPTIONS = future=+lfs, so kbdfile_find()'s directory search does not fail with EOVERFLOW on 32-bit architectures; no change on 64-bit, no exported ABI change Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Fix the armel build: enable large-file support - debian/rules: build with DEB_BUILD_MAINT_OPTIONS = future=+lfs, so kbdfile_find()'s directory search does not fail with EOVERFLOW on 32-bit architectures; no change on 64-bit, no exported ABI change

0 tuxcare-debian11-els kbd_2.3.0-3+tuxcare.els2_amd64.deb 7a81db528c8ee5ba7df1ad53abdea3162915afe1 kbd_2.3.0-3+tuxcare.els2_arm64.deb 68f3a0694dc90624ddd7507f7868425e6f8d61d2 kbd_2.3.0-3+tuxcare.els2_armel.deb 67bb4968e50fa8faa645aa8d67232f768b5e3059 CLSA-2026:1789748401 TuxCare License Agreement 0 * SECURITY UPDATE: stack buffer overflow in cdParseRelunits() and is_valid_time_unit() - debian/patches/CVE-2025-14932.patch: bound the sscanf conversions that parse the time units attribute to the destination buffer sizes - CVE-2025-14932 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: stack buffer overflow in cdParseRelunits() and is_valid_time_unit() - debian/patches/CVE-2025-14932.patch: bound the sscanf conversions that parse the time units attribute to the destination buffer sizes - CVE-2025-14932

0 tuxcare-debian11-els libnetcdf-dev_4.7.4-1+tuxcare.els2_amd64.deb 0cd60e8a88a299d0041bc1c0383fda07e28057f7 libnetcdf18_4.7.4-1+tuxcare.els2_amd64.deb 4059541a43ad4fc971d0047a1598930e0138a492 netcdf-bin_4.7.4-1+tuxcare.els2_amd64.deb 5b2638fe0718f9f726ca2f79d09f8b4ceba34dd5 netcdf-doc_4.7.4-1+tuxcare.els2_all.deb f63063f1dd6fc4bf677972954185dbff92b52747 libnetcdf-dev_4.7.4-1+tuxcare.els2_arm64.deb aeeb290675e6d5b3980852ea12a8687ef8dac8ff libnetcdf18_4.7.4-1+tuxcare.els2_arm64.deb 5fdfb70cb3d2a315ca0f508ad0769f01e1c89a83 netcdf-bin_4.7.4-1+tuxcare.els2_arm64.deb 467b415b83bc03352023d001b36e7eb8baada911 libnetcdf-dev_4.7.4-1+tuxcare.els2_armel.deb 449ef920697158d54479474316fe17fdb695f77d libnetcdf18_4.7.4-1+tuxcare.els2_armel.deb 24b1c03cbd6c808dd9c4e5c7f6080abaf9192205 netcdf-bin_4.7.4-1+tuxcare.els2_armel.deb 8f0e1d7b7474cd614eccb225e1fc4832c56a41db CLSA-2026:1789780826 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds write in the bundled xdgmime magic parser - debian/patches/CVE-2026-16118.patch: parenthesize (ptr + i) before the cast in _xdg_mime_magic_parse_magic_line() in gio/xdgmime/xdgmimemagic.c, so the little-endian byte swap writes at byte offsets instead of scaling by sizeof(type) and writing past the end of matchlet->value and matchlet->mask - CVE-2026-16118 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds write in the bundled xdgmime magic parser - debian/patches/CVE-2026-16118.patch: parenthesize (ptr + i) before the cast in _xdg_mime_magic_parse_magic_line() in gio/xdgmime/xdgmimemagic.c, so the little-endian byte swap writes at byte offsets instead of scaling by sizeof(type) and writing past the end of matchlet->value and matchlet->mask - CVE-2026-16118

0 tuxcare-debian11-els libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els3_amd64.deb cc3bec25ab14e540ee5f9b080569066a9f200aae libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els3_amd64.deb df048ea73820b00a2a735826acd99df583f0dc04 libglib2.0-data_2.66.8-1+deb11u8+tuxcare.els3_all.deb f5cd8f0c6b6e811589e132ec0262fe3e2d877b1f libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els3_amd64.deb fc6dfc0f80aea47e49c4b0904fbec6dd9c718a02 libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els3_amd64.deb af8c422e37f0147d80b9ef3d1e71a9a782f2e509 libglib2.0-doc_2.66.8-1+deb11u8+tuxcare.els3_all.deb c606a8f3fa0b579e43f507e3aecda3ecf2be2980 libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els3_amd64.deb 52af7851822185304cca8ab10afc3829fc24587e libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els3_arm64.deb 2d0f741842ba65813aff36ea6aa65d0943607a33 libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els3_arm64.deb 743628a1c2956e2b89d6bdda08bbecb1bf11f032 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els3_arm64.deb 4db62656088e50c535a2fa87431b1cfd68d4b622 libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els3_arm64.deb a541da140b84b3d0e8fec4c7cfb9890b776a6cef libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els3_arm64.deb 63980f45921e64d75f968cfe40b0c3b661073804 libglib2.0-0_2.66.8-1+deb11u8+tuxcare.els3_armel.deb 215f3c5de63e7e9a861d6b859c49c48dde5af56a libglib2.0-bin_2.66.8-1+deb11u8+tuxcare.els3_armel.deb 66d9e7c644e681d8f251d4b7fd2fc79eebc50444 libglib2.0-dev_2.66.8-1+deb11u8+tuxcare.els3_armel.deb 36c7565b332a906ccbb60739060a2054103398e3 libglib2.0-dev-bin_2.66.8-1+deb11u8+tuxcare.els3_armel.deb 82fea5e6636f28747dae0ab6833a1f1666c82814 libglib2.0-tests_2.66.8-1+deb11u8+tuxcare.els3_armel.deb 74c582ec1340c5edf136bd327b3fabaa55990571 CLSA-2026:1789785440 TuxCare License Agreement 0 * CVE-2026-89158: integer overflow in the compiled-pattern block size computation in pcre2_compile(), giving an undersized allocation and a heap out-of-bounds write; reachable on 32-bit platforms - debian/patches/CVE-2026-89158.patch Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* CVE-2026-89158: integer overflow in the compiled-pattern block size computation in pcre2_compile(), giving an undersized allocation and a heap out-of-bounds write; reachable on 32-bit platforms - debian/patches/CVE-2026-89158.patch

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els4_amd64.deb 4d9b2db50de22efcc9914703faba875c369e43b6 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els4_amd64.deb 7fb365d0b2105e6e8dbb7aa034669dd7d3bf04f1 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els4_amd64.deb 96756ee544a33e82aa9c4173f7262fc6ea161baf libpcre2-dev_10.36-2+deb11u1+tuxcare.els4_amd64.deb d8c5b5cffc82357937ce4c765e01c96c0dd6162c libpcre2-posix2_10.36-2+deb11u1+tuxcare.els4_amd64.deb f132a7cb5ea5a009e8fa4b7dbaa637ce29bee772 pcre2-utils_10.36-2+deb11u1+tuxcare.els4_amd64.deb 7cf4c857e68834d4e7dcc0fed42d8d7d8150f4ad libpcre2-16-0_10.36-2+deb11u1+tuxcare.els4_arm64.deb f5842f1e7e52fccbbcaee15cfabd09b9391dafd5 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els4_arm64.deb 9d97e13ba74ac19785bc94122f962b0ebf4c072c libpcre2-8-0_10.36-2+deb11u1+tuxcare.els4_arm64.deb fcf6a737b8c2cfb020588c5bb2ef544bfc407669 libpcre2-dev_10.36-2+deb11u1+tuxcare.els4_arm64.deb 34ddea45d2e7976ec47ab8b7aad3849419b677e2 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els4_arm64.deb 6e276f13f26dbe4895814f65a4242b1d69e6bce3 pcre2-utils_10.36-2+deb11u1+tuxcare.els4_arm64.deb e1bcac10c454b22945f2ead94b894d3bcd70095e libpcre2-16-0_10.36-2+deb11u1+tuxcare.els4_armel.deb cdef22c0773c10b057ade978e0400cac9799655d libpcre2-32-0_10.36-2+deb11u1+tuxcare.els4_armel.deb 3b98acb0369ba03c3fecb348a13e3bb5dd5873af libpcre2-8-0_10.36-2+deb11u1+tuxcare.els4_armel.deb c868b935ccdc2220de9c0c4e1835cd0c0599e41f libpcre2-dev_10.36-2+deb11u1+tuxcare.els4_armel.deb 9624b41e48808020649bb071ef5a7af10abeea16 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els4_armel.deb 7b56bba13885104b00ec07042dd8dcb4cf89664c pcre2-utils_10.36-2+deb11u1+tuxcare.els4_armel.deb da701e1150679e060b65a59183f56193f0ad51ea CLSA-2026:1789899030 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds write in the internal DNS server via a TSIG-signed packet using DNS name compression - debian/patches/CVE-2026-6949.patch: record the start offset of each dns_res_rec while pulling it and use the last additional record's offset to truncate the buffer for TSIG verification, instead of subtracting a re-pushed TSIG record length that can exceed the packet and underflow packet_len into a huge memcpy() size - CVE-2026-6949 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds write in the internal DNS server via a TSIG-signed packet using DNS name compression - debian/patches/CVE-2026-6949.patch: record the start offset of each dns_res_rec while pulling it and use the last additional record's offset to truncate the buffer for TSIG verification, instead of subtracting a re-pushed TSIG record length that can exceed the packet and underflow packet_len into a huge memcpy() size - CVE-2026-6949

0 tuxcare-debian11-els ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 7327f51b955f40b587197db60d93ba8d9a7ad02a libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 4fb90cc02d3b327929fd86bb80fafbefaed6f933 libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 555929d54eb0a3d7bbe3030b9b6e7cc77abe41a9 libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 02df8f171671de5eaf82542d9248a635a84fdebd libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 193bb226cfc9747035c545224005aed263081b4a libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 1f96556043c475690c3f2f43bf50ddbc07f8dd10 libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 059eeff937dae74e396816b52afa863c2d2ecba2 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 3bc5c8069888a9ca76fc372927101dced66533b4 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 301592159853d5a33ec1ecfe88166d288af8ce3a samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 889cd2bc439fd064fe09c41f4bae24a5edd2ea59 samba-common_4.13.13+dfsg-1~deb11u8+tuxcare.els4_all.deb ec9765d4c0ff6f45394ccef1124ca8f445dfa58d samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 1610815a8e3c8817038b3eae5ee3507001926777 samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 709f534905fc953eff4b0866a9e1b6c826b8ea01 samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 4457ecd9415b9945188934cb0f6a409f885fae64 samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb e121e4963e889c0a6f4198661d244035b9c57462 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb b3e7e54a9eaf5705f9da704e553962598ae30cbf samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb adea10e9ca4313695bb42155f0d4ba89875716fa smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 595ac0b3dede6b5586f474e323e58d1bdccd0bb4 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_amd64.deb 921d5f0ee5a2bc778b68137197fa3c1fabcdb564 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 34b89d1cf624af2dd3123e47a2dada6d629a4004 libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 9a8edf371a475d67fa960cd792db1ebfee352afb libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 997fc667d0e07560c11101516a7aaee3f50220dc libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb dce4f8578afcefa38a490fe10db74966cc4f7458 libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 1520412858555b9497d71d60992bd1c9f7bdc024 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 8894750807560f830bf0a06c182cb83525d5058d libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb d21aeee4258e60f3391da921f962d3f6488092fa python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb ad38b2059967affbd9238d301adbf73e0d071f5e registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 04f04e90236feb9bd8af535a95aa1577b41a4193 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb b1ddcce73b50b98f03f307a2428a5d9070f18b87 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb ef3f0b4dc7cd871e27f9c129af0b97160bec36ac samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 2f6d6e9b592ba8dc927a385ba4da2e9724f619dc samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb aaa255ec78f4aa6aaf9d0ac68921a9582dbe77fd samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 8269a6b84b428678403170bf4c02d81e0d812991 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb e808b99908274e918d07239813af48498aa5bd7b samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 643e338d81e47da7e0a94825d8bb2fd90be54044 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 1b5189e52e2b4d9c9425eb833eaf691ddf806016 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_arm64.deb 52a1cdc2b4167660ae3339aee7b577004654caf1 ctdb_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb b64076ec3520c50c542805c3e2c30581bd856fbc libnss-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 2fed99e41d71c33ec13d0114c622d83b1b3be39d libpam-winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 51bcc50976d06835a492dc53becc22af1fdcb18f libsmbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 5e0e61b513b1d2835c32f617470a1cf796b5f95d libsmbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 91593fb7f90081d77d26908c2bd405d8e1ce8112 libwbclient-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 62a712d8b84a0c498f01ea73fd3b031405dfba04 libwbclient0_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb ad0a8ae39d5ad224ec123de4267c16574103eaa8 python3-samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 0621fe6c10e08ef0e64531f5b98a036240d39c96 registry-tools_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 87464aaeb6f55f76b2138c2495a7e56adb13ce19 samba_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 3a74f5b6db6791efed666a46c21d245687054504 samba-common-bin_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 705ba2455b684e59829ece62b493c6ebfd2dd17f samba-dev_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 3f0eb71ce4be4a9e2a82258ee14f26050985e9eb samba-dsdb-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 5ce741e5dcd4cb9b735bc501227a52187bd3513a samba-libs_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 3153e47e817f1d835d66add5a8d0825cdb74ac64 samba-testsuite_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb e75702b0ac676b205fb18c77f5a4b1fd9d5f3a38 samba-vfs-modules_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 20d79456362beb17c5df65c52aad90c0b4875e35 smbclient_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 860936b5d564c3fbe5f0a71e2bbaf7156abeafd7 winbind_4.13.13+dfsg-1~deb11u8+tuxcare.els4_armel.deb 453736a2c5cce3ec1706458355693165513c92f4 CLSA-2026:1789961064 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds write in stab_xcoff_builtin_type (binutils/stabs.c) - debian/patches/CVE-2021-45078.patch: reject negative and out-of-range XCOFF builtin type numbers instead of indexing info->xcoff_types with them - CVE-2021-45078 * SECURITY UPDATE: heap buffer overflow in read_section_stabs_debugging_info (binutils/rddbg.c) - debian/patches/CVE-2021-46174.patch: check the stab section holds a whole number of entries before reading them - CVE-2021-46174 * SECURITY UPDATE: heap buffer overflow in find_section_in_set (binutils/readelf.c) - debian/patches/CVE-2022-44840.patch: fill the shndx pool by scanning it directly so each set stays NUL terminated for a crafted .debug_cu_index - CVE-2022-44840 * SECURITY UPDATE: out-of-bounds read in parse_module (bfd/vms-alpha.c) - debian/patches/CVE-2022-47673_CVE-2023-25584.patch: sanity check VMS debug record lengths and DST element sizes before reading them - CVE-2022-47673 - CVE-2023-25584 * SECURITY UPDATE: NULL pointer dereference in compare_symbols (binutils/objdump.c) - debian/patches/CVE-2022-47695.patch: guard the section comparison against symbols that have no section - CVE-2022-47695 * SECURITY UPDATE: crash on an uninitialised asymbol from bfd_mach_o_get_synthetic_symtab (bfd/mach-o.c) - debian/patches/CVE-2022-47696.patch: initialise the_bfd on the synthetic symbols so objdump can sort them - CVE-2022-47696 * SECURITY UPDATE: NULL pointer dereference in elf_gc_sweep (bfd/elflink.c) - debian/patches/CVE-2025-5244.patch: skip the gc_mark propagation when a section group has no first member - CVE-2025-5244 * SECURITY UPDATE: NULL pointer dereference in debug_type_samep and debug_write_type (binutils/debug.c) - debian/patches/CVE-2025-5245.patch: handle enum types that carry no name list - CVE-2025-5245 * SECURITY UPDATE: NULL pointer dereference in process_relocs (binutils/readelf.c) - debian/patches/CVE-2025-69649.patch: do not walk the section headers when the file has none - CVE-2025-69649 * SECURITY UPDATE: out-of-bounds reads in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-3441_CVE-2026-3442.patch: bound the XTY_LD x_scnlen csect index by the symbol count rather than by the byte offset into the symbol table, and range-check r_symndx before indexing the symbol hashes - CVE-2026-3441 - CVE-2026-3442 * SECURITY UPDATE: heap buffer overflow in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-6846.patch: size the reloc_info array by the highest section target_index - CVE-2026-6846 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds write in stab_xcoff_builtin_type (binutils/stabs.c) - debian/patches/CVE-2021-45078.patch: reject negative and out-of-range XCOFF builtin type numbers instead of indexing info->xcoff_types with them - CVE-2021-45078 * SECURITY UPDATE: heap buffer overflow in read_section_stabs_debugging_info (binutils/rddbg.c) - debian/patches/CVE-2021-46174.patch: check the stab section holds a whole number of entries before reading them - CVE-2021-46174 * SECURITY UPDATE: heap buffer overflow in find_section_in_set (binutils/readelf.c) - debian/patches/CVE-2022-44840.patch: fill the shndx pool by scanning it directly so each set stays NUL terminated for a crafted .debug_cu_index - CVE-2022-44840 * SECURITY UPDATE: out-of-bounds read in parse_module (bfd/vms-alpha.c) - debian/patches/CVE-2022-47673_CVE-2023-25584.patch: sanity check VMS debug record lengths and DST element sizes before reading them - CVE-2022-47673 - CVE-2023-25584 * SECURITY UPDATE: NULL pointer dereference in compare_symbols (binutils/objdump.c) - debian/patches/CVE-2022-47695.patch: guard the section comparison against symbols that have no section - CVE-2022-47695 * SECURITY UPDATE: crash on an uninitialised asymbol from bfd_mach_o_get_synthetic_symtab (bfd/mach-o.c) - debian/patches/CVE-2022-47696.patch: initialise the_bfd on the synthetic symbols so objdump can sort them - CVE-2022-47696 * SECURITY UPDATE: NULL pointer dereference in elf_gc_sweep (bfd/elflink.c) - debian/patches/CVE-2025-5244.patch: skip the gc_mark propagation when a section group has no first member - CVE-2025-5244 * SECURITY UPDATE: NULL pointer dereference in debug_type_samep and debug_write_type (binutils/debug.c) - debian/patches/CVE-2025-5245.patch: handle enum types that carry no name list - CVE-2025-5245 * SECURITY UPDATE: NULL pointer dereference in process_relocs (binutils/readelf.c) - debian/patches/CVE-2025-69649.patch: do not walk the section headers when the file has none - CVE-2025-69649 * SECURITY UPDATE: out-of-bounds reads in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-3441_CVE-2026-3442.patch: bound the XTY_LD x_scnlen csect index by the symbol count rather than by the byte offset into the symbol table, and range-check r_symndx before indexing the symbol hashes - CVE-2026-3441 - CVE-2026-3442 * SECURITY UPDATE: heap buffer overflow in xcoff_link_add_symbols (bfd/xcofflink.c) - debian/patches/CVE-2026-6846.patch: size the reloc_info array by the highest section target_index - CVE-2026-6846

0 tuxcare-debian11-els binutils_2.35.2-2+tuxcare.els1_amd64.deb cc026d43a75c0fb49072f74e89fbb3332f5dd3c1 binutils-aarch64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb e26b25d16d10ba957dedf4e6db14a3a78a699c63 binutils-alpha-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 5086211992696655243749af7c1bdb3728cc433e binutils-arm-linux-gnueabi_2.35.2-2+tuxcare.els1_amd64.deb 236024214e562b9fac9bafcf51fa50e270f619c7 binutils-arm-linux-gnueabihf_2.35.2-2+tuxcare.els1_amd64.deb b45318d8ef5be106747a72fbab0ab1d868ee43b8 binutils-common_2.35.2-2+tuxcare.els1_amd64.deb a3ec3f6e831ed2024d4440674760373ff6017f46 binutils-dev_2.35.2-2+tuxcare.els1_amd64.deb c6a763aa61a9bed71d49ecd0ad31ff28f0fa837e binutils-doc_2.35.2-2+tuxcare.els1_all.deb 308f4187426d88abc6ba87468d500dfbe8b89195 binutils-for-build_2.35.2-2+tuxcare.els1_all.deb f9a65aaf4ff1e495bc1fec2e63098314db7705cc binutils-for-host_2.35.2-2+tuxcare.els1_amd64.deb e0401cd998ca8b7bf5feb3a5995fdfb3f0844682 binutils-hppa-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 171597b0adfd7e99c0e3d6e33e122f5dbd2c69be binutils-hppa64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 823d6692a87cb109371a1496b8cfe37600778ca6 binutils-i686-gnu_2.35.2-2+tuxcare.els1_amd64.deb f6d481717c7ec3185d00dce0299139ad3a14b479 binutils-i686-kfreebsd-gnu_2.35.2-2+tuxcare.els1_amd64.deb 6d802c81ce20c0c0fb1b41be41e977598174bf13 binutils-i686-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 9409cb1838d40c1614eef8c0188b8c6a9d87d88e binutils-ia64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 10880ccada789f527727d75c6f28fc2a9ecd687b binutils-m68k-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 5ea3933d55832d44b2d0a0feef4970dee58fbea0 binutils-multiarch_2.35.2-2+tuxcare.els1_amd64.deb c652dc906a09cdd09a93240c45fb20c269e43733 binutils-multiarch-dev_2.35.2-2+tuxcare.els1_amd64.deb d084f94ae4b2a104a215a28a9929205af3ee5a1c binutils-powerpc-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb c70807677e99bb5755343e4e606665dc562cf788 binutils-powerpc64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 290d68c7ff314a6aec1492bc99ea5063a243be5e binutils-powerpc64le-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 3416993324da7a62b86fbf7766d365da7f2dd4a0 binutils-riscv64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb f00702e663a01d3245393d3767a4f0751fbdc286 binutils-s390x-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 177a25c040cb0ad93f26c64175a569b44478279d binutils-sh4-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 1e1df00d88bdae789db68bff0e902af41ee9f56a binutils-source_2.35.2-2+tuxcare.els1_all.deb 978b6b06c0f85ef9e74599ee30ff592d31b9c5c9 binutils-sparc64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 13eb1455b2e2e4183905efbb5fa681a4e8445e12 binutils-x86-64-kfreebsd-gnu_2.35.2-2+tuxcare.els1_amd64.deb ac08cd7eeaaaa9bd2e26605ff2a6e4da6061f4e3 binutils-x86-64-linux-gnu_2.35.2-2+tuxcare.els1_amd64.deb 386061c68d267a1b920b691068d0c121727d96c3 binutils-x86-64-linux-gnux32_2.35.2-2+tuxcare.els1_amd64.deb 46756780febcc8bf7175d1d41cc1445d2ee033e4 libbinutils_2.35.2-2+tuxcare.els1_amd64.deb f553826deecdc49df7e5a60a0f97cadfefa2c5d6 libctf-nobfd0_2.35.2-2+tuxcare.els1_amd64.deb a8fcc52491233a0462df2d462f9ee88edd15531a libctf0_2.35.2-2+tuxcare.els1_amd64.deb 02f1ce1776343ea1282f2853f11ed3829183d3be binutils_2.35.2-2+tuxcare.els1_arm64.deb 3bc3b5e34e7a7c28e0ecebed591693771940376f binutils-aarch64-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb 56925f4249be7fca964c3827a7f146ed9cbbd98b binutils-arm-linux-gnueabi_2.35.2-2+tuxcare.els1_arm64.deb 11d5ac910aedb3d8f6cda39926091f1175d34871 binutils-arm-linux-gnueabihf_2.35.2-2+tuxcare.els1_arm64.deb 9279ba747e92e8ffc47d2064eed75390250060d5 binutils-common_2.35.2-2+tuxcare.els1_arm64.deb 4b2209aadf7a5bd281b4919acd83c530a67164e3 binutils-dev_2.35.2-2+tuxcare.els1_arm64.deb fd4744eff98370caeee64b01eb1fdfeba2d6177a binutils-for-host_2.35.2-2+tuxcare.els1_arm64.deb 60479c092dfd67b0e3d8f243f361ddfcda1a2776 binutils-i686-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb 61b2ce574fdbdb54610e15a84b2a22590be1a882 binutils-multiarch_2.35.2-2+tuxcare.els1_arm64.deb 228eae803d7c1f2778f855c6a6172099d1bceb4f binutils-multiarch-dev_2.35.2-2+tuxcare.els1_arm64.deb c0630e6fef8454aa68371b6778fbf467cd646d7c binutils-powerpc64le-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb f6190e78f689471e7a4d92d0d2c9c83624586b9f binutils-riscv64-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb 84a15ee5d6cd0b9cff9b7b5c93e20896b627e30f binutils-s390x-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb 3afd58a658470bd618a84ad2cbe9d2ec5f4f1018 binutils-x86-64-linux-gnu_2.35.2-2+tuxcare.els1_arm64.deb 67501dcfe36b69cd652d7f6f94ad50ce65cb72f1 binutils-x86-64-linux-gnux32_2.35.2-2+tuxcare.els1_arm64.deb eff5e491e9515db24fc1f7be5980e4e4947c1ffa libbinutils_2.35.2-2+tuxcare.els1_arm64.deb 28ea62ca9c6aea7d2c89572207568e057566809a libctf-nobfd0_2.35.2-2+tuxcare.els1_arm64.deb daa4fe16d04176be35d7d762bd6a2c4d55601d49 libctf0_2.35.2-2+tuxcare.els1_arm64.deb aa4305a168baae3f63244e135d5f5d549019f1c8 binutils_2.35.2-2+tuxcare.els1_armel.deb a19e0dce47dcfe0990969eadae97d1417a2c4a2c binutils-arm-linux-gnueabi_2.35.2-2+tuxcare.els1_armel.deb 502ce717ebdffd413c8314450d233ee1e961fd69 binutils-common_2.35.2-2+tuxcare.els1_armel.deb bf6868546ad208d6cc71a3799ecffbda362165fe binutils-dev_2.35.2-2+tuxcare.els1_armel.deb 676f927f3018cb8e4f381b21500ee261058ac4f3 binutils-for-host_2.35.2-2+tuxcare.els1_armel.deb 2fcb2f2131eabed94e751696bf3baa5ed2807e3d binutils-multiarch_2.35.2-2+tuxcare.els1_armel.deb 46b496358996c90a6588da085ccd5f59998278ed binutils-multiarch-dev_2.35.2-2+tuxcare.els1_armel.deb 40a3a678d723d1507a3841f41532d94979cd0c0b libbinutils_2.35.2-2+tuxcare.els1_armel.deb 49cbe5ddf51fd066fb8b785f9f92e6ee72629a60 libctf-nobfd0_2.35.2-2+tuxcare.els1_armel.deb 10d19b1da6b5efa5bf28c8cde11fa4bafc45ab7b libctf0_2.35.2-2+tuxcare.els1_armel.deb 930e10da6fb1492099dbfc198cbb3e3209652ff8 CLSA-2026:1789980999 TuxCare License Agreement 0 * SECURITY UPDATE: insufficient entropy in the hash-flooding protection - debian/patches/CVE-2026-41080.patch: store the hash secret salt as a full 128-bit struct sipkey instead of a single unsigned long, draw 16 bytes of entropy for it in generate_hash_secret_salt(), track whether it was set with the new m_hash_secret_salt_set flag, and add the XML_SetHashSalt16Bytes() API so callers can supply all 16 bytes, in expat/lib/xmlparse.c and expat/lib/expat.h. Previously the SipHash key was half a hardcoded zero and half an unsigned long, which is only four bytes on 32-bit architectures such as armel - CVE-2026-41080 Low Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: insufficient entropy in the hash-flooding protection - debian/patches/CVE-2026-41080.patch: store the hash secret salt as a full 128-bit struct sipkey instead of a single unsigned long, draw 16 bytes of entropy for it in generate_hash_secret_salt(), track whether it was set with the new m_hash_secret_salt_set flag, and add the XML_SetHashSalt16Bytes() API so callers can supply all 16 bytes, in expat/lib/xmlparse.c and expat/lib/expat.h. Previously the SipHash key was half a hardcoded zero and half an unsigned long, which is only four bytes on 32-bit architectures such as armel - CVE-2026-41080

0 tuxcare-debian11-els expat_2.2.10-2+deb11u7+tuxcare.els3_amd64.deb 111b4043f03dd854d25c425e22fe171270839145 libexpat1_2.2.10-2+deb11u7+tuxcare.els3_amd64.deb a3e51f21fec1bd080e8e3b7a5ccf868fa69c1277 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els3_amd64.deb f27d26aa55c66587002bed1a19e11f2fd608e2d9 expat_2.2.10-2+deb11u7+tuxcare.els3_arm64.deb b4ef7e7536d0c892e144f5581ca91111a21e39cd libexpat1_2.2.10-2+deb11u7+tuxcare.els3_arm64.deb 24626eccb67c72f795e72a0e1198782b1a3f3673 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els3_arm64.deb 2259ef037b668ef020cec77a5868c178df489570 expat_2.2.10-2+deb11u7+tuxcare.els3_armel.deb deaeeaa724752e7fbd13b3042c396ad4e007f227 libexpat1_2.2.10-2+deb11u7+tuxcare.els3_armel.deb 42062ceeb29b416a3166a4c1ef126cfc02bbc679 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els3_armel.deb 0037999fd2df76e2f5f6a98f9a35b7973b62cd61 CLSA-2026:1789981287 TuxCare License Agreement 0 * Fix the armel build failing in the test CA - debian/rules: do not build the softhsm2-based test CA on armel, where softhsm2-util cannot find the token it has just initialised; test-only, no change to the shipped binaries Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Fix the armel build failing in the test CA - debian/rules: do not build the softhsm2-based test CA on armel, where softhsm2-util cannot find the token it has just initialised; test-only, no change to the shipped binaries

0 tuxcare-debian11-els libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 490a5c43143dd117239e00264649a466f8c625b5 libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 500fc6fc82f417393af4897b7c4a06d9a9f4aa6c libnss-sss_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 08b88108688320d51ae01291313c85b8895579cb libpam-sss_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 8aea4c843191af9daea29b8639ded7a08e28e6ed libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 03915c4032ad09ddbbf345f6372d332b1eb7a017 libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb cc7d802ee2645c743218ba88c537d1428abde7ef libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 3095e557ad7664d7ee25cf25e3ff9decb16d75a8 libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 040e84aa0f858f52836984fd889d56836e27f961 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb abf45c0c3e727baf16540bdb9d77081857d8a6ab libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 2082c72882dfefcf4c4f505aa8a00e7aa339a6fa libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 7a8435e573b7ec6822991642c74becd0121727b3 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb b7753607616a3718ad49b269e341a6a2a82526f3 libsss-sudo_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 96879ec449fbf9d62b3a741e31f3106c1760c3e9 libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 11c20e16d8edc6c01df535f626e7aeaeb409f660 libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb feaabf3cac900704f9609f0dc925e7ecae1a0c43 python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb b9f86986e4e9617d398e052bf9447ef081a2ef3d python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb d82f5a67cae98c76e2016cc4f3906831251eb079 python3-sss_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb b43f893ac1ad15ecbbe1f14cc431fc665eb4e00f sssd_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 6f4a4d9a40ca2a5a828e0fe9dc12ef3c066fc063 sssd-ad_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb c6c27767f25d87996daeeb9225f83def04eb36a0 sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 4550803c8ae46481ce6f16abd9bef0627d2266f8 sssd-common_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 3f91a36321a63f35068037a005e0cd21b89671d6 sssd-dbus_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb ab9816409085f09a821e12b6c399ec7adfd61e33 sssd-ipa_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 207c1d16cc0c033fb6f2e369004fbf9f80b9d604 sssd-kcm_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb c9c8459c19da620c584aa4376eb2518086aa50b1 sssd-krb5_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 1e4e1bdcbf3abd669ff77cac5d9fc377206261bf sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 0bab22e30d64afb1964f6968485e16e0f5040589 sssd-ldap_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 6bc869ff9285e6da8a974178b8b0e19683f3d113 sssd-proxy_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 4693aa7c7ef98931c0d6eb7becc79fb138307e97 sssd-tools_2.4.1-2+deb11u1+tuxcare.els2_amd64.deb 06d1b7928a5c39f94097a2d984f4a1c1019488b0 libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 76f721c2e6439f77875e039fcbc072611bfaa8b3 libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb d0ddf2e1c87d4c7710c7381e73a959f576505dd5 libnss-sss_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 4356fdd1c79d4f41a219d94e7820214e31452a45 libpam-sss_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 48073b21f33c4f5f59c3dab76c67577a73520d03 libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 2d82cca95584395d46b5b9b69e59a9863a679caf libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb f97f029a99f99ee9ae1f219e8ad379ea42085fb9 libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 68ecd83ba1ca95b7f15b02cb8fb8e34ee49eeb5c libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb c5c63a7184d9e00c0d9b2b1a9275c52eb5cbf2c7 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb f420b992c71275cfa254793ad7766b0538c38f9b libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 61b4d1878a9bf2856943ccd1f859b14f4d5db355 libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb b06a1c7c752a363c0dc3e542d5ad449e2d406104 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 6f5e9b3aa06dedb8967451fff1d30b7e9de3afbd libsss-sudo_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 4cfece5c3ea839eedb0ab6aa57d6909cefe817e1 libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb c2974d27f2248a4c31fd65f90acb7d2b9453598d libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 8686d902a8121f0e665c230685b1fdf93a876313 python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 3c43fa947d05e97551bef4b9e73641f0bde8c14f python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 0f3123605256cbc2d3ef22073cd65ac7c9a50d47 python3-sss_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb d0e237a5c06d7c750a7dd0c88821b68ebc2fafad sssd_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb cc82de2c88944fd054b8f1fec01e93373e3f2cbb sssd-ad_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb b0fa266a21e31734ebb6b02282eb42d3890c5020 sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb a0b7affa635005d24bb50babeafad78c113094d8 sssd-common_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 887ad39b238ca009985cfe9a7db69d8f75b15a4f sssd-dbus_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 57d9a9687286568718c87efe4a9c89950c60c9e8 sssd-ipa_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 2334ec935ea5be10382dcff6a0be9db7acafbc80 sssd-kcm_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb ca313a733ab7773895297d33bab2755e5f16a752 sssd-krb5_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb e8474ac0d102a58b8ba92dde8d06e1a63a424703 sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 3a5bdb5a94283d9bb44a9cebb85c0fd0caf3ddca sssd-ldap_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb baec3a285096f83a0c6849d993d16cf39cdb8987 sssd-proxy_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 7aace72c78772f14dadbd3ac6a3de1bc596fb064 sssd-tools_2.4.1-2+deb11u1+tuxcare.els2_arm64.deb 5dea6b8b9f9a5b08489ecdc5f4832911f76d1070 libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 12bb8ce7aa4882d5ce9e88cadceca788e632b996 libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 3db27e08a48ffc842b0ba7b4141be0c1a68bc13e libnss-sss_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 8126ec935d954452d2243dd5b33e25880ed8cc6e libpam-sss_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 3e62af9550a733cea42426418eed0091c73a2ce9 libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 7b88593a7a6c3bbd7f0c310264ed4036c10c225f libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 8b5a1c764f261efae442dba9fbbc438aa1d0b853 libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 53630b20eca45ee5b80d69b02050dcb8d4f9bbe1 libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_armel.deb e0fb40f5d2e828483bd1b2f8e30b28fc91f8a4b4 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb fb5eba02ef45f8c9fe352d2cd5f5f92e3f529dd6 libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els2_armel.deb ed8123c7e311d9016906e8cd8a267481c221479c libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb fa94a2d558990ab1590b9c5e06299e88db7ca3f0 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els2_armel.deb ea885705602f874a8d2717a56dc500905365c028 libsss-sudo_2.4.1-2+deb11u1+tuxcare.els2_armel.deb fec77ed1a63661fd87563d0e163fc4580bfccc98 libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 449419651ac6afb2508553b96eb597d9c222ffeb libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els2_armel.deb aa75c4fa9f7698b3a9cb7fa6a71a6d31012f5635 python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 163ccdb74c44a75f0381e6f5190dffa5e3228aeb python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 46da9b28b19d3512d54b34b9ecea17aed097abed python3-sss_2.4.1-2+deb11u1+tuxcare.els2_armel.deb d319f6acbff4c2b58e230245d69aa2b994833653 sssd_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 14ad0dbc8b4431d5395778e461b60bad1e156ec7 sssd-ad_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 18df2990ae6d0fa9deeb54ca7e69ef692d814556 sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els2_armel.deb aa4af0ea773768a56a11ba9b18cbcb1b95619291 sssd-common_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 0a94a444bcb9e1b9dbb1a1125028b393349246ae sssd-dbus_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 181f68969753bbf0f0fcfdf69ffe4d5db593aa9b sssd-ipa_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 12d5dfd775ca07f030390afe1381d0ae00d1ac19 sssd-kcm_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 3148fe13c98e0cd00a42534e3b035db5501146a1 sssd-krb5_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 622f2f5b31cdd192aa2a79c89b90933f407300aa sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 98d5fbfec713f5a8cf1dc3207e57db6c01ecb4ff sssd-ldap_2.4.1-2+deb11u1+tuxcare.els2_armel.deb a7345cb042c13bb97ef9f5ef78785db1c18d0aac sssd-proxy_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 57b517812574cd21a29487d31439f2d671c63548 sssd-tools_2.4.1-2+deb11u1+tuxcare.els2_armel.deb 2de4fedce8f6fe1294df2745dd89c374bfb4cc67 CLSA-2026:1789981592 TuxCare License Agreement 0 * SECURITY UPDATE: Memory resource leak in the pixel cache - debian/patches/CVE-2026-86420.patch: release the acquired memory resource in OpenPixelCache() when the pixel allocation fails in magick/cache.c - CVE-2026-86420 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Memory resource leak in the pixel cache - debian/patches/CVE-2026-86420.patch: release the acquired memory resource in OpenPixelCache() when the pixel allocation fails in magick/cache.c - CVE-2026-86420

0 tuxcare-debian11-els imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb cee0b787180f525bd739b448663d7051f51a084e imagemagick-6-common_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 220434bfcca84ea30cd9914bfa3d13f740a689e1 imagemagick-6-doc_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb c78d990a1efd958d6a75073e08d6eb109b2b155f imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb e443d79cfc35f979fc5b8c4d1bc8d47d782ddd01 imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb ab6d6c1e49eaa60e990bb487ffc8fd35b34f177b imagemagick-common_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb dc98613c7ad4aef64538cba95fd1f6288cddde5b imagemagick-doc_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 8bb5b3b7b2e5a9149e87834a062e00c32e3fbc2c libimage-magick-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 3fc1234e2cbc507af1aea6527276ad0a18fa6a2a libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 3eda1efb9f5cd07a2b7c6886dae2b9d408c5d810 libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb b8b529ac00eda2dd44ea65f676d12a0dd6074aa7 libmagick++-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb be8a92aa60ba9feb2f7bcbdad46129cb495ee238 libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 04c0000fa4e184c35392f213fca60abe041c1c97 libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 345dcdfbd58a1321bcf4538065f7fae2e0f0d2b6 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb be6d96db26108e23f92c6ad75b12be0aa7854b70 libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 7d761b6c8f3f383701a1616601a4590dac77d6c5 libmagick++-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 6a0386467e82b5ac3a1f67de63d2d07675dc44e2 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb f98cdb35191335ae624048379646ac9391ff4bb4 libmagickcore-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 7ed401278a84c80daba9daedec3fc56cc4edc8e8 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 10a883d17d99c3bfad705f5a6806802c9e65f648 libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 8788720574415fa5ed40abfa82f78b71b4a0cc7b libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 345248a28162699214ae19748d09303f079fe65c libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 4fbda3442f5280ac3892f3349750b5f55ea08777 libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb 4e1a7f1298f1351c41c3e3059afa2d4bf66356d6 libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb bb79f65bd426e2f31c90d70c33bcc431b1f551ec libmagickcore-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 25568410a48f2111d4f38024fe7987afcf4326ed libmagickwand-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 90bd3ef491c412ffff684cb6118e4d85fda245cc libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb ea9bc3240c5c7db85336751cb63d4657b23a7786 libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb a01d1270fc1dbba4ef37c1b3bdf2649698b43946 libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb fb063d24957bfedc8ed50b8b4bdb42a278f0a588 libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_amd64.deb eceae2f2f1fe7d96aa7ea1cd70ec2c4dee4ee192 libmagickwand-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb 7f295ba402d14c4df0ab16a4dc575cd1eb5912ba perlmagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_all.deb ff1ef43508365336eec707656976c897190620ed imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 9aac0f0b59325399f1d90542bb523d41c0a58393 imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 23f8cd5b417658bd20217db11c19d4345e789212 imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 3e52893d428158db1f249feee0843aaa4398184b libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb d0bb2b35ce008eb0d8af264f0090d25101c4ff19 libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 77059bf856495e568e4196564b60c6a84a38f1e1 libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 86669e0fde7c89399b3bd90ee9e7ed531ffab4d5 libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 59b4f9c97332972bac5a291535ba2007dd4730d7 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 8ae5d324f3b579119b1a98297dbeeba9ee33ce9b libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb e35f1c4d9c0bf15f0e86c0b7dfd612ed23ac0a43 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 03f2e49217be5ac71dcab140cd3f175e93a2e3b0 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 739be33f6bf3187b8a03f1cd7e496bc9bd4b696a libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb db00152716a8f1c89e66458740097a29c8923bcf libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 4a40a5b4572ede15e6b11f80bf371977e1ac94ac libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 97116d50d7bce80c1037c4cc1a9e1fb4ab5aea1e libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 38f247060fa51d097bf8b8f5d216e817d7133a76 libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 6b28bf84e8ee93475f4c689e64a66bb4e50f080f libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 640dabd8832d8c4490c924323930b657188d5a8c libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 135d4211b07650a2181f25eab0b5fca00c44798a libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 800cb185ebda875d809e3cdbed952e6cbdada59c libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_arm64.deb 999c9fb87322ed367e7957e1d0a44c3c3c0b217a imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 8a4af0beef2affeb0cb4ffc41a347c53fb0f8be2 imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb dec8581d00fb8d80702e1243d09baeed942a437b imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 7982ead976e697bf5f3bc61852c0d6085f154f74 libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 69d859e185aaacfaaaab5c49dfd022fef6463f05 libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb c695f448e29731c137a3fa55ee6795d088a28d1c libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 79842d057a03c0fcdd73beb6fdb568105047ec97 libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 22f5dac7684ede33b819fac84ca1758462d2f4f7 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb a91fc427ab1c4e7e889b9a3ac4a24b0d47dd232e libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb cbbcb611ab61c929d55c719d5f19abcc6f3ef9a4 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb e871250db590406dd0d72fb437f3de15901bd398 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 8f725db06ed56ddc4a025060f2d08db18ed7be3d libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 80fc748be3dbbf93f66b8e418cd35f4ee135342a libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb dbff7fb95d4dc8414dbc5535b4523db9b3cf18fd libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 9f6de1ba723811b389915928cc037f1f6f6e3a33 libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 0a26b32e22dd14ed66e94bf07f81c589c1f30170 libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb b9618af5cf6c38951f7c6026d2a746d5b09d80fd libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb fa3cf20368b2cc0da7e5ba99ad1ef9a2e4485d8d libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb d1ce57a5872aee1f628079dcc04fd85d8c9ccbc0 libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 52c54b7aceb23ff21a37e93e5cb22ec80c7404d5 libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els1_armel.deb 6e5d133968c1f1107bcd64838cdcb8bbd5a7a540 CLSA-2026:1790072149 TuxCare License Agreement 0 * SECURITY UPDATE: Infinite loop in the pcre2test utility when a subject line used a negative repeat count in a \[...]{n} escape, because the repeat count was rejected only when it was exactly zero - debian/patches/CVE-2022-41409.patch: reject zero or negative repeat counts for \[...]{n} subject escapes in src/pcre2test.c, with test coverage in testdata/testinput2 and testdata/testoutput2 - CVE-2022-41409 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Infinite loop in the pcre2test utility when a subject line used a negative repeat count in a \[...]{n} escape, because the repeat count was rejected only when it was exactly zero - debian/patches/CVE-2022-41409.patch: reject zero or negative repeat counts for \[...]{n} subject escapes in src/pcre2test.c, with test coverage in testdata/testinput2 and testdata/testoutput2 - CVE-2022-41409

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els5_amd64.deb 0fd174aa37b68e6ff1f5357ef20e438cd892ba97 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els5_amd64.deb 749802e1657da28fe485999f17b9f372f25c92a5 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els5_amd64.deb 326fcfad1ab4ea385a20b7706766a14f4f3389d0 libpcre2-dev_10.36-2+deb11u1+tuxcare.els5_amd64.deb 2b2ef03c5c75844719dba3cf59542bf76deb97fa libpcre2-posix2_10.36-2+deb11u1+tuxcare.els5_amd64.deb b4f16e3af39c4d0eac92f0c291ef341e5ace4d1b pcre2-utils_10.36-2+deb11u1+tuxcare.els5_amd64.deb 2fe66149f6d6140e1d31af6990545f231995da7c libpcre2-16-0_10.36-2+deb11u1+tuxcare.els5_arm64.deb 1e31a959c3b989fa7dd4ba3a89836ab6c796a52c libpcre2-32-0_10.36-2+deb11u1+tuxcare.els5_arm64.deb 853a5bee0973ea08a7dbce7a72ec689e1a0b343e libpcre2-8-0_10.36-2+deb11u1+tuxcare.els5_arm64.deb 76111e4cbd5a319668645e5328ea2b2f8e465d3b libpcre2-dev_10.36-2+deb11u1+tuxcare.els5_arm64.deb ce1e935f4b691479d2c6f8d4fcd8af36a7f0bdb3 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els5_arm64.deb 4a1a394840ef668a0d22b627da04b3d90e3c78e2 pcre2-utils_10.36-2+deb11u1+tuxcare.els5_arm64.deb 8313306faf2dcc9873a17d6460255d39842327c0 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els5_armel.deb 6a66c7f335d77a65f566453c6d39a8a5934fff5e libpcre2-32-0_10.36-2+deb11u1+tuxcare.els5_armel.deb 35450caf784af866709f8240582a5803c8e94b71 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els5_armel.deb 38d9e530e685435b85d7726d730815ea61407996 libpcre2-dev_10.36-2+deb11u1+tuxcare.els5_armel.deb b4280989ee978ba28cf3bac4efa8e6dbc8c918a5 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els5_armel.deb 074aeedd357fd274c8eb7baa6c2a7f8c0a8e4d53 pcre2-utils_10.36-2+deb11u1+tuxcare.els5_armel.deb 0e3e5a260bc5b5476285d7b77902490a274f0240 CLSA-2026:1790082267 TuxCare License Agreement 0 * SECURITY UPDATE: Heap buffer overflow in CMS AES-WRAP-PAD key unwrap - debian/patches/CVE-2026-63072.patch: size the key-unwrap output buffer in crypto/cms/cms_kari.c for the worst case so a failed AES-WRAP-PAD unwrap cannot write 8 bytes past the allocation, with the upstream regression test in test/cmsapitest.c and test/recipes/80-test_cmsapi.t - CVE-2026-63072 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap buffer overflow in CMS AES-WRAP-PAD key unwrap - debian/patches/CVE-2026-63072.patch: size the key-unwrap output buffer in crypto/cms/cms_kari.c for the worst case so a failed AES-WRAP-PAD unwrap cannot write 8 bytes past the allocation, with the upstream regression test in test/cmsapitest.c and test/recipes/80-test_cmsapi.t - CVE-2026-63072

0 tuxcare-debian11-els libssl-dev_1.1.1w-0+deb11u8+tuxcare.els2_amd64.deb fca1da85c1a491bb6332ed9e45638d8c5e43f16c libssl-doc_1.1.1w-0+deb11u8+tuxcare.els2_all.deb 1de19de97a5f5fcf7ca36deb1ee181b15d64e0f4 libssl1.1_1.1.1w-0+deb11u8+tuxcare.els2_amd64.deb 7ee51dc5c2184f42219f575cf8fc906cd0b1f7a6 openssl_1.1.1w-0+deb11u8+tuxcare.els2_amd64.deb 908bd38b8d806a0d9946bb02f800be10d0203103 libssl-dev_1.1.1w-0+deb11u8+tuxcare.els2_arm64.deb 3ac662c3eb5c6942bd6b8d561f975ebf6ecc904f libssl1.1_1.1.1w-0+deb11u8+tuxcare.els2_arm64.deb 85800223f443d75d72b5ce5247b4ce09b80be9b9 openssl_1.1.1w-0+deb11u8+tuxcare.els2_arm64.deb 7c4a22d336838041f405eae124761afd546b4e40 libssl-dev_1.1.1w-0+deb11u8+tuxcare.els2_armel.deb dad76b4445ba17d48e44a6bccf72c9f96644bc7f libssl1.1_1.1.1w-0+deb11u8+tuxcare.els2_armel.deb 15a5632364974a30fefea09906c9350a1fc3ab63 openssl_1.1.1w-0+deb11u8+tuxcare.els2_armel.deb 709730addae65c196b76327f0a5805aae8588a76 CLSA-2026:1790159743 TuxCare License Agreement 0 * SECURITY UPDATE: stack buffer overflow when a bz2 decompressor is reused after a decompression error - debian/patches/CVE-2026-9669.patch: record the libbz2 error in BZ2FileObject and BZ2DecompObject in Modules/bz2module.c, route every read through a Util_BzRead() wrapper that reports the recorded error instead of re-entering the errored stream, and reject a reused BZ2Decompressor.decompress() with ValueError - CVE-2026-9669 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: stack buffer overflow when a bz2 decompressor is reused after a decompression error - debian/patches/CVE-2026-9669.patch: record the libbz2 error in BZ2FileObject and BZ2DecompObject in Modules/bz2module.c, route every read through a Util_BzRead() wrapper that reports the recorded error instead of re-entering the errored stream, and reject a reused BZ2Decompressor.decompress() with ValueError - CVE-2026-9669

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els3_all.deb a2e5964a5ae3fc963bdbe24c3e7884c70c93f03b libpython2.7_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb 3d83a4d56d281f9460cefa4643ce36df90e32118 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb 311b3b1694c4d5bdfa9411ed7c27ee8a9a32a45f libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb f1c85d0948c43f4d1041e67a175dfa4e750f5b06 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb 08a08d724020e877e6cee692aff693b53bfc4a16 libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els3_all.deb a6e99097660ca57f9ed716a41a301f154c9a7d16 python2.7_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb 4c0823057c3cfe24f3c25d2f8bfd35954e3a86c9 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb e034310fe272ed0cb1b6c509ad8e4294cecbe76b python2.7-doc_2.7.18-8+deb11u1+tuxcare.els3_all.deb 2373246c63987109c69ca08e6b50fef28e7efca7 python2.7-examples_2.7.18-8+deb11u1+tuxcare.els3_all.deb 08972ac1ed9372cd957071886fae0bb048a2c460 python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_amd64.deb eefea8a2f364a74541e3ecf180a75feb992613d2 libpython2.7_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb 8a258b4dc566e2a1572d371a4ca49046caa085a6 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb d9b30e145fe047840ed1fe47a58d28bfe3a14e0d libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb 995e744e414d5932eaeeb17b799cf7297221f91c libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb 34fcb14c556f41d5e2a7b261c5c3dbe916dd65ce python2.7_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb 77f1e759df26f317a34301b2d4942a72e907f6f6 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb 2e9247cdf4bf7aaf15322bd77c5d4a0eef99cf60 python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_arm64.deb fd925f65dc48b19da6436fa563218c6ff99a5bf3 libpython2.7_2.7.18-8+deb11u1+tuxcare.els3_armel.deb 587bf449b0edbca281013ae0927c01f1b416809e libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_armel.deb e50505eb6488ebf60d224a181ced68c232a3f0b0 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_armel.deb 3a3804670fd499324438bb04cd66bdcddf4844b4 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els3_armel.deb c50c8b1ed88d5190347dbd068f3f49f12b3a0ad4 python2.7_2.7.18-8+deb11u1+tuxcare.els3_armel.deb 3bba6ad3870f67d265b90f37005aa6913f8c1714 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els3_armel.deb 41cd6d0da30a027323ab94a26ac64d7ead7ef50e python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els3_armel.deb 7cfe4f1b60b733f0a6848292b0db6bb9db4144d9 CLSA-2026:1790180200 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer overflow/underflow scrolling without valid screen - debian/patches/CVE-2022-2206.patch: re-clamp cmdline_row/msg_row after a terminal resize shrinks Rows, in check_shellsize() in src/term.c. - CVE-2022-2206 * SECURITY UPDATE: illegal memory access when 'spellfile' has a very long file name - debian/patches/CVE-2021-3928.patch: check that preword is not empty before backing up a pointer into it in suggest_trie_walk() in src/spellsuggest.c. - CVE-2021-3928 * SECURITY UPDATE: using freed memory with ]d/[d/]D/[D/]i/[i/]I/[I - debian/patches/CVE-2022-1898.patch: copy the identifier found under the cursor before passing it to find_pattern_in_path(), in nv_brackets() in src/normal.c. - CVE-2022-1898 * SECURITY UPDATE: using freed memory when 'spellfile' triggers a SpellFileMissing autocmd that wipes out the buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while spell_load_lang() runs, in src/spell.c. - CVE-2022-3352 * SECURITY UPDATE: use-after-free with autocommands that change the window layout while editing another file - debian/patches/CVE-2023-4733.patch: invalidate the old window pointer after autocommands may have closed it, in do_ecmd() in src/ex_cmds.c. - CVE-2023-4733 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer overflow/underflow scrolling without valid screen - debian/patches/CVE-2022-2206.patch: re-clamp cmdline_row/msg_row after a terminal resize shrinks Rows, in check_shellsize() in src/term.c. - CVE-2022-2206 * SECURITY UPDATE: illegal memory access when 'spellfile' has a very long file name - debian/patches/CVE-2021-3928.patch: check that preword is not empty before backing up a pointer into it in suggest_trie_walk() in src/spellsuggest.c. - CVE-2021-3928 * SECURITY UPDATE: using freed memory with ]d/[d/]D/[D/]i/[i/]I/[I - debian/patches/CVE-2022-1898.patch: copy the identifier found under the cursor before passing it to find_pattern_in_path(), in nv_brackets() in src/normal.c. - CVE-2022-1898 * SECURITY UPDATE: using freed memory when 'spellfile' triggers a SpellFileMissing autocmd that wipes out the buffer - debian/patches/CVE-2022-3352.patch: disallow deleting the current buffer while spell_load_lang() runs, in src/spell.c. - CVE-2022-3352 * SECURITY UPDATE: use-after-free with autocommands that change the window layout while editing another file - debian/patches/CVE-2023-4733.patch: invalidate the old window pointer after autocommands may have closed it, in do_ecmd() in src/ex_cmds.c. - CVE-2023-4733

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb 9b78c7e8e310c5506b090a30112b3bc65c954966 vim-athena_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb eba87fc137508e645197fb90346847d70a8e403d vim-common_8.2.2434-3+deb11u3+tuxcare.els13_all.deb 0196afa596bf117804c072730e218bfb712a440b vim-doc_8.2.2434-3+deb11u3+tuxcare.els13_all.deb ca46640e20138b5a19de1bfb777619c576e05743 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els13_all.deb 06df76064fc58c4cc60145b34c3ce79195f8b8e0 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb c74da1e878cbf397738b75dd76db9be7549fda55 vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els13_all.deb ca74421b52973c3c537ad0ebc5275a386b213898 vim-nox_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb a6b1e0f27af8c0868ecb89fb50a2ab0843ed13a1 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els13_all.deb 9f5f361b26bb92ca3669b193c6f57f22a23dfb87 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb 8cb276d31d1e2a620826d316eab89f639f2c8e96 xxd_8.2.2434-3+deb11u3+tuxcare.els13_amd64.deb a0c3124a4e5112dbffd385de7d056bcb41a54d23 vim_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb 78dceca16cbc7513656cf47f6cdda88c31b605e8 vim-athena_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb ef0ea4260a160020f5b9744d4d9f715d994bcbd4 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb 118d7f2bfbf48912b2314c54a26d02a3a2194337 vim-nox_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb 669799acd835f7204864ce1083a0dc3bd0a561ed vim-tiny_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb 15308df79d3b167987498156161fbd387c43677c xxd_8.2.2434-3+deb11u3+tuxcare.els13_arm64.deb 181703106bc2159db3d8374c55e9416d0aedb789 vim_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb 2ff989aeb22a2e752d44b740a9da1eba7fc1490b vim-athena_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb de775e127bd7bd66f8c07413c1fd9ee0255dcba0 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb 3fac90b27e80f6ee989ed86aa0c53ea3f69613ac vim-nox_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb ed00b895bdc28187e16104079bf5a90967c1ea38 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb e590867cc59a9822e533a9499dd475687b2978cc xxd_8.2.2434-3+deb11u3+tuxcare.els13_armel.deb 14c624628b14694ad9dca09029700ae43fe69e6f CLSA-2026:1790237255 TuxCare License Agreement 0 * SECURITY UPDATE: insufficient entropy in the expat hash salt - debian/patches/CVE-2026-7210.patch: append a dedicated 16-byte expat_hashsalt16 field to _Py_HashSecret_t in Include/object.h, which _PyRandom_Init() seeds along with the rest of the secret, and pass it to libexpat through XML_SetHashSalt16Bytes() in Modules/pyexpat.c and Modules/_elementtree.c when that symbol is available, so the SipHash key libexpat derives is 128 bits instead of the 32 or 64 bits the legacy XML_SetHashSalt() could carry - debian/control, debian/control.in: libpython2.7-stdlib now depends on libexpat1 (>= 2.2.10-2+deb11u7+tuxcare.els3), the first libexpat on this platform to export XML_SetHashSalt16Bytes - CVE-2026-7210 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: insufficient entropy in the expat hash salt - debian/patches/CVE-2026-7210.patch: append a dedicated 16-byte expat_hashsalt16 field to _Py_HashSecret_t in Include/object.h, which _PyRandom_Init() seeds along with the rest of the secret, and pass it to libexpat through XML_SetHashSalt16Bytes() in Modules/pyexpat.c and Modules/_elementtree.c when that symbol is available, so the SipHash key libexpat derives is 128 bits instead of the 32 or 64 bits the legacy XML_SetHashSalt() could carry - debian/control, debian/control.in: libpython2.7-stdlib now depends on libexpat1 (>= 2.2.10-2+deb11u7+tuxcare.els3), the first libexpat on this platform to export XML_SetHashSalt16Bytes - CVE-2026-7210

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els4_all.deb ca909df2054f2fbaee058f99e9e739b1289f0b8d libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb f838c7d0fecac2e766dec8ad24500f20a21c111e libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb e8ba4d9348a463c7a5e3bfe7aa5ec2573aa06d37 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb b45d4c034e839145fc4cf33d7d34215072646b32 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb 5546d70d3eeb77c2fabf089dd18316f8e91fcec4 libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els4_all.deb 3ad017d84b244f3fa7b41828578dda4992afaa46 python2.7_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb 01f4f8a78af7fcd4ac554fa6101580828ca37ee1 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb 377520b8001c005d857a1143f72ab0a25dab2c67 python2.7-doc_2.7.18-8+deb11u1+tuxcare.els4_all.deb 15366654610ac8e19e99bd9f688d057bd85a8191 python2.7-examples_2.7.18-8+deb11u1+tuxcare.els4_all.deb 49d7778b475fd93fd5c6c378c4a3d6c552866d9b python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_amd64.deb 613bbf6c6aee8db3297544b36c4281f44c134954 libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb 7af4cc87b1995f94d75a5ddcd08c9171bf57ec4f libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb aa31959540dafb3ecf27743c2836bec958c856d0 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb 6d19b1111ff265968daead8a0963274394cead94 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb 81c991c5ac062cb9641da9ec695314adf670043c python2.7_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb 0eb946f01fa9df9ecea2c292b31394784800996f python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb e1c59b2d5c37d2ad71ad44e4a5a083d601306f7e python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_arm64.deb a47b24caf4f28df66ec5af6e1af625c1e4816310 libpython2.7_2.7.18-8+deb11u1+tuxcare.els4_armel.deb b455fd0e9f101c085db1f308199650ed2a2aede5 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_armel.deb a8c3942aa3e521d243199198ef8546c4d20db6fb libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_armel.deb eb474e25af3a8a5639f5872cd3b6e5897af1ad3a libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els4_armel.deb e1651d5e515a22e1f70a23cf585ce4bab608bf2d python2.7_2.7.18-8+deb11u1+tuxcare.els4_armel.deb abed6de86daa144edc1090a196125875a7ce57ba python2.7-dev_2.7.18-8+deb11u1+tuxcare.els4_armel.deb 76d50934af409d50538161dd9c2ea0bc6d41dd1c python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els4_armel.deb 20793279dbc24d2aa2f79e8387e89b72263bb950 CLSA-2026:1790328600 TuxCare License Agreement 0 * SECURITY UPDATE: --delete scope expansion by a malicious sender - debian/patches/CVE-2026-53789.patch: downgrade implied-parent directories to FLAG_IMPLIED_DIR on the receiver, covering synthetic and legacy implied parents, so a sender cannot mark a parent as a content dir and have delete_in_dir() sweep pre-existing siblings. The parse_filter_file() module-dir strip that upstream bundled into the same commit is not taken here: it is the CVE-2026-53786 fix per upstream NEWS and ships in debian/patches/CVE-2026-53786.patch - the patch's two regression tests are rewritten against this tree's shell testsuite, as upstream's pytest-based ones need a harness 3.2.3 does not have; debian/control gains python3 <!nocheck> in Build-Depends for them - CVE-2026-53789 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: --delete scope expansion by a malicious sender - debian/patches/CVE-2026-53789.patch: downgrade implied-parent directories to FLAG_IMPLIED_DIR on the receiver, covering synthetic and legacy implied parents, so a sender cannot mark a parent as a content dir and have delete_in_dir() sweep pre-existing siblings. The parse_filter_file() module-dir strip that upstream bundled into the same commit is not taken here: it is the CVE-2026-53786 fix per upstream NEWS and ships in debian/patches/CVE-2026-53786.patch - the patch's two regression tests are rewritten against this tree's shell testsuite, as upstream's pytest-based ones need a harness 3.2.3 does not have; debian/control gains python3 <!nocheck> in Build-Depends for them - CVE-2026-53789

0 tuxcare-debian11-els rsync_3.2.3-4+deb11u4+tuxcare.els5_amd64.deb 6d8047cf302f1e6d5c50c41bc48fd1ed8a8d2e6c rsync_3.2.3-4+deb11u4+tuxcare.els5_arm64.deb b35ba6476873ece5af0be1478a05c9ba5107958d rsync_3.2.3-4+deb11u4+tuxcare.els5_armel.deb 3e086bf1efbdd0ac616a256bb68d246086a0b354 CLSA-2026:1790237820 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer over-read scanning for quote text objects with a stale Visual selection - debian/patches/CVE-2022-2124.patch: add a NUL-boundary check to the existing-Visual-selection quote-scan loop in current_quote() in src/textobject.c. - CVE-2022-2124 * SECURITY UPDATE: use-after-free using a mark position in a regexp - debian/patches/CVE-2021-3974.patch: refetch the current line under REG_MULTI after a mark lookup may have flushed it, in the NFA_MARK/NFA_MARK_GT/NFA_MARK_LT handling in src/regexp_nfa.c. - CVE-2021-3974 * SECURITY UPDATE: heap buffer over-read using z= in Visual mode beyond the end of the line - debian/patches/CVE-2022-0943.patch: clamp badlen to the actual line length in spell_suggest() in src/spellsuggest.c; the comparison is taken in its post-8.2.4565 form, folding in upstream's correction that casts both operands to int, because without it the subtraction is evaluated in size_t and underflows, leaving the clamp a no-op. - CVE-2022-0943 * SECURITY UPDATE: use-after-free reading a buffer for 'diff' without blocking autocommands - debian/patches/CVE-2023-5535.patch: block autocommands around the dummy-buffer readfile() in buf_contents_changed() in src/buffer.c. - CVE-2023-5535 * SECURITY UPDATE: use-after-free when 'tagfunc' wipes out the buffer holding 'complete' - debian/patches/CVE-2022-3297.patch: make a copy of 'complete' instead of aliasing the option value, revalidate curbuf after the completion callback, and validate the cursor line, in src/insexpand.c and src/move.c; the src/move.c hunk is taken in its post-9.0.0581 form, folding in upstream's same-day follow-up that clamps only the cursor line, because clamping the column there breaks incsearch at end of line. - CVE-2022-3297 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer over-read scanning for quote text objects with a stale Visual selection - debian/patches/CVE-2022-2124.patch: add a NUL-boundary check to the existing-Visual-selection quote-scan loop in current_quote() in src/textobject.c. - CVE-2022-2124 * SECURITY UPDATE: use-after-free using a mark position in a regexp - debian/patches/CVE-2021-3974.patch: refetch the current line under REG_MULTI after a mark lookup may have flushed it, in the NFA_MARK/NFA_MARK_GT/NFA_MARK_LT handling in src/regexp_nfa.c. - CVE-2021-3974 * SECURITY UPDATE: heap buffer over-read using z= in Visual mode beyond the end of the line - debian/patches/CVE-2022-0943.patch: clamp badlen to the actual line length in spell_suggest() in src/spellsuggest.c; the comparison is taken in its post-8.2.4565 form, folding in upstream's correction that casts both operands to int, because without it the subtraction is evaluated in size_t and underflows, leaving the clamp a no-op. - CVE-2022-0943 * SECURITY UPDATE: use-after-free reading a buffer for 'diff' without blocking autocommands - debian/patches/CVE-2023-5535.patch: block autocommands around the dummy-buffer readfile() in buf_contents_changed() in src/buffer.c. - CVE-2023-5535 * SECURITY UPDATE: use-after-free when 'tagfunc' wipes out the buffer holding 'complete' - debian/patches/CVE-2022-3297.patch: make a copy of 'complete' instead of aliasing the option value, revalidate curbuf after the completion callback, and validate the cursor line, in src/insexpand.c and src/move.c; the src/move.c hunk is taken in its post-9.0.0581 form, folding in upstream's same-day follow-up that clamps only the cursor line, because clamping the column there breaks incsearch at end of line. - CVE-2022-3297

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb 951eae6d44def649bf0220d8bbb8a95f6e97e668 vim-athena_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb 2a6b6cb2f6820c1af6eeabb273b9422c2a835eaf vim-common_8.2.2434-3+deb11u3+tuxcare.els14_all.deb 182fb23659aa574f7bc0b708d54f1592aa82cc21 vim-doc_8.2.2434-3+deb11u3+tuxcare.els14_all.deb 916b5c8c9d3e882b7e8d7639892bf440c42a65b9 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els14_all.deb f732eeec936cadf9686466e413f0bae47b1d7253 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb a4b131d88d6337ef613514926dd6786ff9e8833e vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els14_all.deb 39bc998ae992f26c03d16e0ccf6a6706918e5bd6 vim-nox_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb f44f4c6d4977691f2f6e252a77ca12b37485c1a0 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els14_all.deb 09620e2360db6a72692b130c5c1a3e9861fbaed7 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb 9213f2109b88f384988f5a88ab025d2a8f90ddfc xxd_8.2.2434-3+deb11u3+tuxcare.els14_amd64.deb e1d5eb6b379a7fa4c18d2aed2f3c905859acacd1 vim_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb d6118801a30c3390effceac58439746e23b7492f vim-athena_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb a51087fca532aa0799ca2f1ef1ae3e3c27294084 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb 32f96a660572efd51b343581601c49d7c1feb0b2 vim-nox_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb b771ff07d2690f757e13de71fa3c1b22cd3423cd vim-tiny_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb e08cf32c7d2ccd8b73d7d62fb9c3f0b032eedd98 xxd_8.2.2434-3+deb11u3+tuxcare.els14_arm64.deb 07fec8924ef26c72bcbdcb8faa88e7223c3b8ff6 vim_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb 4dadc317a9892f215cdfcbf139efb4fdea4c36fa vim-athena_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb bd15a5b754f7e4863db0f1abf4ed278af74f2558 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb a7ad153e009f6687bc29de17c12f3c3d4b2f6a96 vim-nox_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb f14b1acb1eb6ad687463379f3ae71024f5ea31a3 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb 7cb8dc50836a9130d08cb1d63da112d55b0d0f0f xxd_8.2.2434-3+deb11u3+tuxcare.els14_armel.deb 8a67bdc20b7d13c431a6659def16f301999f69c8 CLSA-2026:1790709344 TuxCare License Agreement 0 * SECURITY UPDATE: double free in the Python SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: drop the extra Py_DECREF() on each enumeration value string in pythonAttributeDecl(), since PyList_SetItem() already steals that reference, so a DTD with an enumerated attribute no longer frees the strings twice - CVE-2026-74860 * debian/rules: run the C regression programs (runtest, testapi, testrecurse, testcatalog, testchar, testdict) and the Python binding tests in the arch build; skip only the cases whose data the +dfsg tarball does not ship (runxmlconf, runtest's threads group, reader5.py) Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: double free in the Python SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: drop the extra Py_DECREF() on each enumeration value string in pythonAttributeDecl(), since PyList_SetItem() already steals that reference, so a DTD with an enumerated attribute no longer frees the strings twice - CVE-2026-74860 * debian/rules: run the C regression programs (runtest, testapi, testrecurse, testcatalog, testchar, testdict) and the Python binding tests in the arch build; skip only the cases whose data the +dfsg tarball does not ship (runxmlconf, runtest's threads group, reader5.py)

0 tuxcare-debian11-els libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_amd64.deb f96574f8cea893a0f04a133502de759e54486b7c libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_amd64.deb 870fd81a05c37c1f242491469ecfca156954dfad libxml2-doc_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_all.deb f65938358ed9afcb5276fe8eb865c4380b54c98e libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_amd64.deb 5efc71621f46c71cf3f402896068ef6c2a0ae292 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_amd64.deb e7af9b57ebf85b260b0073829e5ec6b09c71b03e libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_arm64.deb 5dc143e1ea5021c0213843e4f252853e31dd777e libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_arm64.deb 041e25d4d938579346844882977a7c855b31f38c libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_arm64.deb d14cdc660b4196120ff53406c8c9ba2f7efcade2 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_arm64.deb 0327d24f3ba6c697ed869fc58ec3a0cbf2ae80d4 libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_armel.deb f35723e633199cab1eee4b5f322831b21073e9c2 libxml2-dev_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_armel.deb 15d079178198188522f78e49cbbecd134f1c03d7 libxml2-utils_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_armel.deb 0db919996790f0d5a91e841d5b5c8fdc2833eba1 python3-libxml2_2.9.10+dfsg-6.7+deb11u10+tuxcare.els3_armel.deb 47fa6488c43020bb70cb8c765e5faaffdd9232f6 CLSA-2026:1790709490 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read in decode_tag_internal() - debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the pulled-up length instead of the full buffer length in event_tagging.c - CVE-2026-63383 * SECURITY UPDATE: integer overflow in evtag_unmarshal_header() - debian/patches/CVE-2026-63384.patch: reject payload lengths above INT_MAX in event_tagging.c, include/event2/tag.h - CVE-2026-63384 * SECURITY UPDATE: heap out-of-bounds write in bufferevent_socket_set_conn_address_() via an AF_UNIX peer address - debian/patches/CVE-2026-63388.patch: check the address length regardless of NDEBUG, fail the connection on an over-long address and make conn_address large enough for AF_UNIX in bufferevent_sock.c, bufferevent-internal.h, http.c - CVE-2026-63388 * SECURITY UPDATE: off-by-one stack buffer overflow in dnsname_to_labels() - debian/patches/CVE-2026-63387.patch: refuse to write the terminating label byte past the end of the buffer in evdns.c - CVE-2026-63387 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read in decode_tag_internal() - debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the pulled-up length instead of the full buffer length in event_tagging.c - CVE-2026-63383 * SECURITY UPDATE: integer overflow in evtag_unmarshal_header() - debian/patches/CVE-2026-63384.patch: reject payload lengths above INT_MAX in event_tagging.c, include/event2/tag.h - CVE-2026-63384 * SECURITY UPDATE: heap out-of-bounds write in bufferevent_socket_set_conn_address_() via an AF_UNIX peer address - debian/patches/CVE-2026-63388.patch: check the address length regardless of NDEBUG, fail the connection on an over-long address and make conn_address large enough for AF_UNIX in bufferevent_sock.c, bufferevent-internal.h, http.c - CVE-2026-63388 * SECURITY UPDATE: off-by-one stack buffer overflow in dnsname_to_labels() - debian/patches/CVE-2026-63387.patch: refuse to write the terminating label byte past the end of the buffer in evdns.c - CVE-2026-63387

0 tuxcare-debian11-els libevent-2.1-7_2.1.12-stable-1+tuxcare.els1_amd64.deb c4b225ad2362e6fe1736ec2b9de2a78cd872289c libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els1_amd64.deb fab8abb04e3558bae1e118407ba08b721956153c libevent-dev_2.1.12-stable-1+tuxcare.els1_amd64.deb 0144734bf8ac92878504f38bf20ac72878096282 libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els1_amd64.deb 0e42f55f620c478cf8ee933b06bbd05e51781679 libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els1_amd64.deb f84d255af5a780412619776f949d7c45119dc316 libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els1_amd64.deb e17dfae3d6bb33027cfe13e5f309eb4271145bcf libevent-2.1-7_2.1.12-stable-1+tuxcare.els1_arm64.deb f55e8f1dc3ccb17514e28b7521955450da96b1c6 libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els1_arm64.deb 3e30a072b045c30f73082d4a077f6f9bd472d300 libevent-dev_2.1.12-stable-1+tuxcare.els1_arm64.deb b6d888d2bdefc2f4a53c8c937cdc1cc5fdaee932 libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els1_arm64.deb e1b04dd749a42ed5c76b79c2a9af13f1bbd17783 libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els1_arm64.deb 71454b9b04124f77b13ca5865eaa5f7c3480a2c2 libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els1_arm64.deb a024a4382eb0c91d7c1c369b2ffee8387c866e91 libevent-2.1-7_2.1.12-stable-1+tuxcare.els1_armel.deb 8ce2b4ca89deac4ab76ce3b8a8e1593525854f61 libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els1_armel.deb 5ad785287929b04d694ed2ad121eec8e3a3141d8 libevent-dev_2.1.12-stable-1+tuxcare.els1_armel.deb a96a7b0092bb2bed314772e85a9ea1b2ffda1627 libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els1_armel.deb a2efc380c84a4fcf94192504e1d3cae9d3920df9 libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els1_armel.deb 8e5e3074fbcaa0aebf889555bfa1db0f105daf3a libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els1_armel.deb 91f968216598c4b1f480ed03c54797a581a8a39f CLSA-2026:1790790148 TuxCare License Agreement 0 * SECURITY UPDATE: a resolver using dns64 with break-dnssec could abort on a partially excluded AAAA RRset cached with a NOQNAME proof (use-after-free on the filter64 path) - debian/patches/CVE-2026-19666.patch: clear the NOQNAME proof alias on the DNS64 filter64 path - CVE-2026-19666 * SECURITY UPDATE: a resolver could abort after caching a negative answer of exactly 65536 bytes as a zero-length negative cache record - debian/patches/CVE-2026-19667.patch: reject negative cache records that do not fit in a dns_rdata_t - CVE-2026-19667 * SECURITY UPDATE: a resolver could abort on a wildcard answer whose NOQNAME proof owner carries both a signed NSEC3 and an unsigned NSEC - debian/patches/CVE-2026-80274.patch: record the denial type the validator accepted and use it when caching and serving the NOQNAME proof; adds dns_rdataset_addnoqnametype() to keep the libdns ABI - CVE-2026-80274 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: a resolver using dns64 with break-dnssec could abort on a partially excluded AAAA RRset cached with a NOQNAME proof (use-after-free on the filter64 path) - debian/patches/CVE-2026-19666.patch: clear the NOQNAME proof alias on the DNS64 filter64 path - CVE-2026-19666 * SECURITY UPDATE: a resolver could abort after caching a negative answer of exactly 65536 bytes as a zero-length negative cache record - debian/patches/CVE-2026-19667.patch: reject negative cache records that do not fit in a dns_rdata_t - CVE-2026-19667 * SECURITY UPDATE: a resolver could abort on a wildcard answer whose NOQNAME proof owner carries both a signed NSEC3 and an unsigned NSEC - debian/patches/CVE-2026-80274.patch: record the denial type the validator accepted and use it when caching and serving the NOQNAME proof; adds dns_rdataset_addnoqnametype() to keep the libdns ABI - CVE-2026-80274

0 tuxcare-debian11-els bind9_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb 18e432298346b729952c3788edac16e88e47f731 bind9-dev_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb 74d9ea729e65e99af1837288403a7de67475ade9 bind9-dnsutils_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb 7c86442f66b8cdd677cfdb3f5fb8511dd973c663 bind9-doc_9.16.50-1~deb11u6+tuxcare.els1_all.deb c1734e857e6a593defcd70e144ce7578c381774c bind9-host_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb 7c95ba0150cd6768a6646674fb653be285a685d7 bind9-libs_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb 76603874db509fdda2b647b457e19144d560202b bind9-utils_9.16.50-1~deb11u6+tuxcare.els1_amd64.deb f0a687d3f658f62a36362d85d0aa7f3fb2504d52 bind9utils_9.16.50-1~deb11u6+tuxcare.els1_all.deb 029c5cd2604675a4b9b1a6f912babcc59f71131f dnsutils_9.16.50-1~deb11u6+tuxcare.els1_all.deb 3c42553733b137995d12da3d507b45bbfb79449c bind9_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb b983241055852cd2eb6c2b82e003686147664d1f bind9-dev_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb 9702b6c44694505caa42c409b81ddde3940dfe51 bind9-dnsutils_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb 5bc1f6afc56817d358105b0d4d284dd45c99bc26 bind9-host_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb 57032cf41fa598d723c1f8b753fcd1e1f2a54552 bind9-libs_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb ef34a1837a289a8068b6229ee9fe1db417d93200 bind9-utils_9.16.50-1~deb11u6+tuxcare.els1_arm64.deb b604865abff06f201f702a6694e90805a1acb5a9 bind9_9.16.50-1~deb11u6+tuxcare.els1_armel.deb 77b75762aaa59144b906a0cba0a7292cb9a1fb5d bind9-dev_9.16.50-1~deb11u6+tuxcare.els1_armel.deb a89fc3cfb26e6cf91cbea2eaa7d7b5607a181ecd bind9-dnsutils_9.16.50-1~deb11u6+tuxcare.els1_armel.deb 75aca3090b37ca5a069c45d89bb81e69416a011e bind9-host_9.16.50-1~deb11u6+tuxcare.els1_armel.deb dd56ee440d7f604b4dee9745d1c9564b72c6524c bind9-libs_9.16.50-1~deb11u6+tuxcare.els1_armel.deb 6188e88686a6bbddc5da4b5be4b4db2d97559993 bind9-utils_9.16.50-1~deb11u6+tuxcare.els1_armel.deb 57adef9f9f2b52d0dd60e814fe35e6aac2f7b113 CLSA-2026:1790836943 TuxCare License Agreement 0 * SECURITY UPDATE: change of permissions and modification time of a file outside the destination via a tar hard link to a symlink - debian/patches/CVE-2026-82049.patch: resolve the target of a hard link member with os.path.realpath() in TarFile.makelink() in Lib/tarfile.py, so the extracted hard link points to the file itself instead of duplicating a symlink whose relative target escapes the destination directory; make both link calls inside the upstream AttributeError/NotImplementedError/OSError envelope, so a link refused by the system (e.g. link(2) on a directory) falls back to extracting the linked member instead of aborting the extraction - CVE-2026-82049 * SECURITY UPDATE: tar extraction filter bypass via a hard link to a symlink stored at a deeper name - debian/patches/CVE-2026-11940.patch: pass the member that a hard link falls back to extracting through the extraction filter, under its own name and under the link's name, in TarFile.makelink_with_filter() in Lib/tarfile.py, and raise LinkFallbackError when the filter rejects it, so a symlink validated at its deeper archived name can no longer be recreated at the link's shallower path outside the destination; skip that member when the filter returns None for it under the link's name instead of extracting it anyway - CVE-2026-11940 * debian/rules: run test_tarfile verbosely in the check target, so the result of each tarfile test appears in the build log Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: change of permissions and modification time of a file outside the destination via a tar hard link to a symlink - debian/patches/CVE-2026-82049.patch: resolve the target of a hard link member with os.path.realpath() in TarFile.makelink() in Lib/tarfile.py, so the extracted hard link points to the file itself instead of duplicating a symlink whose relative target escapes the destination directory; make both link calls inside the upstream AttributeError/NotImplementedError/OSError envelope, so a link refused by the system (e.g. link(2) on a directory) falls back to extracting the linked member instead of aborting the extraction - CVE-2026-82049 * SECURITY UPDATE: tar extraction filter bypass via a hard link to a symlink stored at a deeper name - debian/patches/CVE-2026-11940.patch: pass the member that a hard link falls back to extracting through the extraction filter, under its own name and under the link's name, in TarFile.makelink_with_filter() in Lib/tarfile.py, and raise LinkFallbackError when the filter rejects it, so a symlink validated at its deeper archived name can no longer be recreated at the link's shallower path outside the destination; skip that member when the filter returns None for it under the link's name instead of extracting it anyway - CVE-2026-11940 * debian/rules: run test_tarfile verbosely in the check target, so the result of each tarfile test appears in the build log

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els5_all.deb 5db3b7572ef2ee22523f5f50a74a098a3bee8ddd libpython2.7_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 2021354942cfe6b33306b4a418a933f8eefdd99c libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 103ae9d0ea94e7de6255376fd23eb33901d471ef libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 0b6e0fabe6e0e387a03d7ab2ccd47e1fbd786ceb libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 02d62d8efe837ea23f3f314ebc2c0593933a08c7 libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els5_all.deb 6b933602ebd7704c70b323c23e01404935a1d73f python2.7_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 2c627c64f6ccdf9af8331b3d23918febd1404aa0 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 1b696db9264677831fedc164e9c50ac1dc8fa72c python2.7-doc_2.7.18-8+deb11u1+tuxcare.els5_all.deb 0dac9a9050c298e0c2724361bfbffc149f38be18 python2.7-examples_2.7.18-8+deb11u1+tuxcare.els5_all.deb 7db48075d3db8a7cb143631a4a6b9cf8911570be python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_amd64.deb 6c8b8a4b6878475d9ede0e75c862ce7057cc3e26 libpython2.7_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb 53e02b27dffd819256b049c44f608dab0672be60 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb 4441b4be0e50c43051ab0b4a0d6a52b93c6cb8df libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb 7a214b98f37f30b420c89c686ce94d8b6c4d9f8e libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb 83737f213bc1b74e5a58713cf269ca36b8568656 python2.7_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb de4cfbe5d0847765905969c7d1ab8b6c4f6b1e81 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb bf0c256bfd5da846be889de2b57c4634e641e22f python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_arm64.deb b456e3aa8f7b00052dc7e53b1b2302a123b850bf libpython2.7_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 3738c18563c5000ff58fffd91526386b7ed65fec libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 1a9874f537f48ba106522367e30e9cf7c92eb59d libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 538fc3281ab2572648e4ef655d3d0d46a0482cbf libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 09f5eee7279de97b26afce08503c2222bb1b5ee2 python2.7_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 85265332c963db533f2c5790210af0d281585408 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 9201b5606c673b3b19e1bb2160d0b5db6431d7df python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els5_armel.deb 247cbcedc53805aa38c051cc4b622918d560ddab CLSA-2026:1790852768 TuxCare License Agreement 0 * SECURITY UPDATE: heap out-of-bounds read and NUL write in Proxy Protocol v1 header parsing - debian/patches/CVE-2026-94054.patch: size the heap copy of the received PROXY v1 line by its string length instead of by the number of bytes read, so the search for the terminating CR and the NUL written there stay inside the copy - CVE-2026-94054 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap out-of-bounds read and NUL write in Proxy Protocol v1 header parsing - debian/patches/CVE-2026-94054.patch: size the heap copy of the received PROXY v1 line by its string length instead of by the number of bytes read, so the search for the terminating CR and the NUL written there stay inside the copy - CVE-2026-94054

0 tuxcare-debian11-els exim4_4.94.2-7+deb11u6+tuxcare.els2_all.deb 054897d3d5196a7d7749d67df61e5c08fec20311 exim4-base_4.94.2-7+deb11u6+tuxcare.els2_amd64.deb 66d476ae4b5ee0e006f30f60ebd25184fc849a45 exim4-config_4.94.2-7+deb11u6+tuxcare.els2_all.deb 4b1e79f2bb45d3c8130703aada9d6e8c18afc0ca exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els2_amd64.deb 6855ca6f8d15f1e6ec8c85220622aab63dcabb61 exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els2_amd64.deb f79485a86e7b78cf8aab247ea9cc9c1cf5f9c171 exim4-dev_4.94.2-7+deb11u6+tuxcare.els2_amd64.deb fe13b88afe9e0c3340295462f331fb6a985a6a5b eximon4_4.94.2-7+deb11u6+tuxcare.els2_amd64.deb 821348228e305a8efa79ce7e1c819d72490423a2 exim4-base_4.94.2-7+deb11u6+tuxcare.els2_arm64.deb 1d74f9094fc08032353fd5eb0a5eafbb925c47df exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els2_arm64.deb 5f6c5918971d2e478eaea4586721d5ec9ab48d98 exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els2_arm64.deb ef8571784b30b3175e34418d1f6b58d2943c71c5 exim4-dev_4.94.2-7+deb11u6+tuxcare.els2_arm64.deb 965ebc6c7f45195ea70f762a060d45b06c5c5504 eximon4_4.94.2-7+deb11u6+tuxcare.els2_arm64.deb 0a1f9a3741162d05b421ee2a114aec494f226dfc exim4-base_4.94.2-7+deb11u6+tuxcare.els2_armel.deb adb2b330a3b6131e30e74e608bcc4510117bf6e7 exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els2_armel.deb 1388219c45517e33be48a20e990e3eed27055c5e exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els2_armel.deb 5c1f3b0a9e9a0aaf14a48b562413046268bfcc58 exim4-dev_4.94.2-7+deb11u6+tuxcare.els2_armel.deb 575de79abbcb560cc5f366eb534cfe2cb573108f eximon4_4.94.2-7+deb11u6+tuxcare.els2_armel.deb 2f0688033d59da185905619ab97b994d708869d3 CLSA-2026:1790866058 TuxCare License Agreement 0 * SECURITY UPDATE: Heap buffer overflow and possible remote code execution when digesting DNSKEY - debian/patches/CVE-2026-81642.patch: check the scratch buffer space in ds_create_dnskey_digest() before writing the DNSKEY owner name and RDATA into it - CVE-2026-81642 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap buffer overflow and possible remote code execution when digesting DNSKEY - debian/patches/CVE-2026-81642.patch: check the scratch buffer space in ds_create_dnskey_digest() before writing the DNSKEY owner name and RDATA into it - CVE-2026-81642

0 tuxcare-debian11-els libunbound-dev_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb b80358277e725b6f79044f9c2d7d570653dc2bca libunbound8_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb 72459510a225a7d77d210a3d76d8a9b12beae7a9 python3-unbound_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb 64f02650615b185b47049987106c5ca4b4fa9b2e unbound_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb 9c14d580d4edf803eb86a1d27e24002bd0fb58cd unbound-anchor_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb 54e8e35c4c8de49fca87f1eef5f73e2f513493a0 unbound-host_1.13.1-1+deb11u7+tuxcare.els3_amd64.deb 0002bae8b1cdf36d2072c8ab611784af34905c3d libunbound-dev_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb 4bb65ec5c7262221a54aa608971179bee318aa4f libunbound8_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb 22a9f8fe231b711c1c8900f82ec3b34abd96ebb2 python3-unbound_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb cd89f34fb1e8dbc7911215c8a52f0b2755a16126 unbound_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb 629fae153d713c1d7c38f892a76b3f8e2f6978fb unbound-anchor_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb a95938f24332b56022c8158120c2a62f54932a0c unbound-host_1.13.1-1+deb11u7+tuxcare.els3_arm64.deb aac62367fc27efe3d66a411a25d68c9d93de3f50 libunbound-dev_1.13.1-1+deb11u7+tuxcare.els3_armel.deb c93fc180d0f4d6f23a8143d05bb66086faeaf08b libunbound8_1.13.1-1+deb11u7+tuxcare.els3_armel.deb 4fadbd9066a592da420788f80d965c94c3237834 python3-unbound_1.13.1-1+deb11u7+tuxcare.els3_armel.deb c32a66c3c3717fbe67dc4cb5d207967a6f99f274 unbound_1.13.1-1+deb11u7+tuxcare.els3_armel.deb 4dc3b885e0a8b226a04c18867f3df4504e5031f7 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els3_armel.deb e85badf3b71cbe44496a80a56a97d90f0d062f49 unbound-host_1.13.1-1+deb11u7+tuxcare.els3_armel.deb 1906f59cbc31763973f4804314c2312a8b945804 CLSA-2026:1790873998 TuxCare License Agreement 0 * SECURITY UPDATE: Heap buffer overflow in RainerScript replace() - debian/patches/CVE-2026-78002.patch: rewind the replace() sizing pass by the full failed partial-match length so the allocated buffer matches what the copy pass writes, and add a regression test - CVE-2026-78002 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Heap buffer overflow in RainerScript replace() - debian/patches/CVE-2026-78002.patch: rewind the replace() sizing pass by the full failed partial-match length so the allocated buffer matches what the copy pass writes, and add a regression test - CVE-2026-78002

0 tuxcare-debian11-els rsyslog_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 2aedc086a757284b0974bd811401d65ca733c30b rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb c0fcfcdf25f8de51e0fd39f2d66bfc00e7c854ef rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 9a7ed0853f2d7632cbec57eddc07ff610794da3d rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 52a0bacae5a896ddb92e8a24e2fcf0e90e5b9724 rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb da87eda0c211fa70348e5fc5c76a61c516298f51 rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 71ae5870c53fcf6418235cada48ac3985b6ef95b rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb c1d3a173b6bcb349317b8ddf9ed20b47d7847069 rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 18da3948b5808b48d9d4e5dba2e7dc11aa258b23 rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb b4fffebb8c78cfdade37083dae52c8a618e922ef rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb f87ee330af2f4608199252ae34d953edcaae735d rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb c9b7c67138adaf2c291304220e85f9ade8842ba1 rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els2_amd64.deb 573a52a9228640ad7f306315a25de1068c40efb8 rsyslog_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb 79bf9a812dc4eaed8e84ed43b6c32d74faed9647 rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb 4baea025295a7447ab45f1110550d067d1d21bff rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb b9b57ec5b96d4273541810957eb0a2969a5e0844 rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb af9c0e3fae73b8304de9bdd0a9df7e0b511aaa34 rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb bb59b8341a38a5a4bbd5afb135968bd5a2f201c6 rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb fdb75e51c81c5caef3a7a31b6cd068a9764f9f8c rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb b70b87377128d934795ebfce31c35269b72f24b9 rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb c562b7278897458316dfefdaa16c167e7840af57 rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb 3bbedd97299c3c14ffe4ca602f6cdf080cacfeb7 rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb 2174737b55cf6f0b0f39f99783290f58af95df50 rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb e7dc91713ec97eea9079c62f79e3b37ce47885bc rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els2_arm64.deb 4f4f2a2309176f5e8dd1016172496111491bd466 rsyslog_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb fa44d2b35d648ac2a6d8244d443c7c219f9ec2a3 rsyslog-czmq_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 7aa00900790eaeb3938c07ad01fd5ba7651cbf38 rsyslog-elasticsearch_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb d2ed3db52b150354c363cbe54a560a66ed491fd1 rsyslog-gnutls_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 6924706638750548fe0ad6784ef6b4b1df36d0cc rsyslog-gssapi_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 09ddc9c11cccc0362806d51e02c650b9d4853bd8 rsyslog-hiredis_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 40d741b5c948e13306150048dfc622c6f243c3f9 rsyslog-kafka_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 7e93f9caa61ba44f9fb79e0d26f7cfd3e582e59e rsyslog-mongodb_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb bea96ea9045f8ca4c20a6bef259bf59b53f40e8f rsyslog-mysql_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb b758750bc21b99b42cc7690491b4fbabc7e187c7 rsyslog-openssl_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb ac8f5a6774e57f03b39c4e15334cd8ec8afd3b97 rsyslog-pgsql_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 7381e4aa080d3734a15852690f3b5089a26115e7 rsyslog-relp_8.2102.0-2+deb11u1+tuxcare.els2_armel.deb 37b5c2a9b1a38a8fc37c0f26339a7f35a98dbd23 CLSA-2026:1790916663 TuxCare License Agreement 0 * SECURITY UPDATE: memory leak in the MSL decoder - debian/patches/CVE-2026-86421.patch: memory leak in the MSL decoder - CVE-2026-86421 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: memory leak in the MSL decoder - debian/patches/CVE-2026-86421.patch: memory leak in the MSL decoder - CVE-2026-86421

0 tuxcare-debian11-els imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 8e9bdf67d6a39310d1ff2b7b6a1f404296d76f6e imagemagick-6-common_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb ea532ed5ffb69315d99a0a1eae9b7463c1ce5392 imagemagick-6-doc_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 55eeae4ff78d280eb00af547879e85f2c5dae9da imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 174349e185bbf6f60474db0c57f764bb2b3fb3ba imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 2dd7bc2dfaacbc41be9cd8fe083a8764debccadb imagemagick-common_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb aefad242c59b4f2a59bc93658187c2306336945d imagemagick-doc_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 2a2627efdd12709d34edd4f2fdf97af967802f18 libimage-magick-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 5694d2baac029bfe1e8590003d0b694f5c124099 libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 6d64c4adb9b4d17f8674ff6a0401cc191643feda libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb b39e213f6025d78e5fb4eb667a1c4c91022a5f5a libmagick++-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb de142c9c61e206f8aecaba0694a2c43d8131f2ed libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 4940ee2043ea8741d1390fccdf258aee995d5b3b libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 81caa13fc6f8e54bfd31aad6e747a92a2d4ea571 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb f2fa0016d77ba6022d8d36dbdb03ff91cffdbf6c libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb d5b8ba6451a35756a1702e02be59ce297c6efc58 libmagick++-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb d9f35498d185e7841dd57988866774cde1883b76 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 778bbf193eb276ed0fc06ab282253d208ac8f015 libmagickcore-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 98e7d76d1e322b68aed171fdb21ee51eef6f6828 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb faedd8387255b699f019d4e30ec2bde7c0b2e1d3 libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 20834322228f2f7d10575cb635c018dda994b53d libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 66f088c85c148c51e360ac75b61ba41a0acbfdef libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 292ed13a0acad896959980f085ccc70e805e9857 libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb ce0ede4ceb6e038ef53a05e73c4630cd05ac5b3b libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 684e24dbc4a6afb13997a10f580ea4220cf3d251 libmagickcore-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb a73a6a6e91779612612a02875642bc677a9bd294 libmagickwand-6-headers_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb a55ffcf1b44e7dec8458671982226413a9ebfd0d libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb ac8a3140a89cfdb26f836503c04293eb24c39fa0 libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 1b0f056c1cafa7ae58253770ffde7cbf1f063dd8 libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb 77c8d9bcefe3436e59b920e1dc5e54d12e6e809b libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_amd64.deb acda94494d9426e62bf3cd9cd250e769518cb87e libmagickwand-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 5a9169d951a3f0079b1ce2e79b129cf4fbc2310d perlmagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_all.deb 1e02817f6c37065015135ab495a0cc2389c04254 imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb cf39777ada8a5666a4267588d1b88cf60497fa14 imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 437258e8a7f47b7a0f2092f7fff143804a373751 imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 1814b889dbaaccbbd5fc8d68f37966f6764cbe8b libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb b8fc20c292fcac640497342500e440a84a82f761 libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb bf1821be4f615adee10b159a344920f749976371 libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb c1de312e718662119f1a4a1382226c8a07d2fe17 libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb a8e9097edad66755c6ac12b5ef24a39823aa86b0 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb c0e760af914d981ae245c8a4aa3bff21381eeb07 libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 601eb624d921a26de958cc460c3e647c3209e634 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb cac1f928324af33af29f88c216e19a012e59e591 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb e311e579b65fb79a1ca50efde173cfc3c873e401 libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb dd39bb22684d5ce6efc6debdbf3885ccd9b9b58f libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb d1ca6388d9d6c4e278deb4f65a31296ca7cc4635 libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb a9bb41a3143711539a4c18c28ec8cce17e01fbb8 libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb e43c933a5fe28d746b6c69ffa645f98270990f35 libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb a380ebbe610a792b5b46f28fa47a81910b2bfbc0 libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 15c8fdf5c6dd8b53d654d70e51cd65726440cb6a libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 8d278c85bc32765aa86417a7383b417d1a21eedc libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 8091385d95aa59d39fc97409234396e7d614848b libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_arm64.deb 4c445b0c44f113f801025c199ebc328d290c67e8 imagemagick_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb e995085aea1a5ff4e5b1a3b4c26112c7b6ce9d50 imagemagick-6.q16_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 318c788c4339cad256ab31cbbeafec700d0f5395 imagemagick-6.q16hdri_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb d10cfe583365168b198d75c4525746c65e021dcf libimage-magick-q16-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 7782b84a8b41805f064ea5d5b9e13ce04a972dc1 libimage-magick-q16hdri-perl_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 03cd18fd628e792f6256095d4f20428cb3b622d1 libmagick++-6.q16-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb bd1eae304ed5b12ea3e9826a3cc24ce3c2b3dcae libmagick++-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 59c52534d1fd3e94f0c46a87fc6206814bec5b65 libmagick++-6.q16hdri-8_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 18930a1ab39d4087b1a615a919bc3d3be6d534f8 libmagick++-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb b57bafbf90239b41868d822b90747c875eb73840 libmagickcore-6-arch-config_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 3bffc8ba6ec10e1ce15990a0ac6d7e4a7b2d4de7 libmagickcore-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 604468a326133727da62faab1a40f76f8964bd00 libmagickcore-6.q16-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb f83a7f1eb7d861010a736f6369d25e36c9caadcc libmagickcore-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb f7bfe675e6af6ce799a679805cb164677382cf86 libmagickcore-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 92140b7f348e33e3e171de4b5f33ad8ec544eb8b libmagickcore-6.q16hdri-6-extra_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb ab9e4e0cdab4197d84d78476d2eaee71025ecb23 libmagickcore-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 89b36e3ca8be600e302afc95b0f37e26286375f4 libmagickwand-6.q16-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb aa6f707ac52cfcb8f1c1b394a43ffbf09e9114cc libmagickwand-6.q16-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 859dac34e9fa179519ced5629a114733ffbfd1d2 libmagickwand-6.q16hdri-6_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 7430e9015b0db5a93b3f06d9d38a67310da8c43e libmagickwand-6.q16hdri-dev_6.9.11.60+dfsg-1.3+deb11u16+tuxcare.els2_armel.deb 0bde3207b66741815b3ed4b877291dcfc6bdb1b4 CLSA-2026:1790924522 TuxCare License Agreement 0 * SECURITY UPDATE: memory corruption when the number of aggregate terms in a query exceeds the maximum number of columns - debian/patches/CVE-2025-6965.patch: raise an error as soon as the SQLITE_LIMIT_COLUMN limit is exceeded, so the i16 Expr.iAgg index cannot be truncated and indexed out of bounds - CVE-2025-6965 * SECURITY UPDATE: memory corruption in the FTS5 extension when an FTS5 MATCH query is run against a crafted database - debian/patches/CVE-2026-11822_CVE-2026-11824.patch: validate szLeaf in fts5LeafRead() so the chunk-length integer underflow in fts5ChunkIterate() cannot occur; one upstream change covers both CVEs - CVE-2026-11822 - CVE-2026-11824 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: memory corruption when the number of aggregate terms in a query exceeds the maximum number of columns - debian/patches/CVE-2025-6965.patch: raise an error as soon as the SQLITE_LIMIT_COLUMN limit is exceeded, so the i16 Expr.iAgg index cannot be truncated and indexed out of bounds - CVE-2025-6965 * SECURITY UPDATE: memory corruption in the FTS5 extension when an FTS5 MATCH query is run against a crafted database - debian/patches/CVE-2026-11822_CVE-2026-11824.patch: validate szLeaf in fts5LeafRead() so the chunk-length integer underflow in fts5ChunkIterate() cannot occur; one upstream change covers both CVEs - CVE-2026-11822 - CVE-2026-11824

0 tuxcare-debian11-els lemon_3.34.1-3+deb11u1+tuxcare.els2_amd64.deb 6135d42076ef3a2b1d02d5f37ee71c14449294af libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els2_amd64.deb f7632900a8bbde8c58e2a4905d0104f581dd6ced libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els2_amd64.deb e6b51cb08d313deff53daed46f0c227805b3e220 libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els2_amd64.deb c3de5825682f962c6fb18dd90268ad9e52e914f8 sqlite3_3.34.1-3+deb11u1+tuxcare.els2_amd64.deb 19d3de5a4916e9b662b98722bcd198e24310fc8d sqlite3-doc_3.34.1-3+deb11u1+tuxcare.els2_all.deb c9aab22007a4fe006d3e96dcfa1f4fce4aa593ac lemon_3.34.1-3+deb11u1+tuxcare.els2_arm64.deb 2c18448185af58c736f5915c4fbf1c7752701776 libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els2_arm64.deb 400c1b6b7bf98706ab89b4fa4cc654dfa904bb2e libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els2_arm64.deb 44682a1a0c22933a163cb65c9d10fe199dbe1594 libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els2_arm64.deb f9500eae3fd383b260e928bb9e5655dd26f5e092 sqlite3_3.34.1-3+deb11u1+tuxcare.els2_arm64.deb febae0282af060155045dd852d424dd0ce91867a lemon_3.34.1-3+deb11u1+tuxcare.els2_armel.deb e5d38bae06467ab3a7c822294537a3a2469bbc0e libsqlite3-0_3.34.1-3+deb11u1+tuxcare.els2_armel.deb 99c68eb47019257449c02e6f1afc10a76a214fb1 libsqlite3-dev_3.34.1-3+deb11u1+tuxcare.els2_armel.deb 887dfd761cd0e4dae78a2ea947d5684b0a6d1073 libsqlite3-tcl_3.34.1-3+deb11u1+tuxcare.els2_armel.deb 8c71afe272aaadab2111a00c3a0a4f704401be29 sqlite3_3.34.1-3+deb11u1+tuxcare.els2_armel.deb 8e4a9f1142795282fb26db041004283c0c1164f1 CLSA-2026:1790925629 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds write in XkbGetMap reply handling - debian/patches/CVE-2026-88806.patch: check that firstKeyAct + nKeyActs does not exceed max_key_code + 1 in _XkbReadKeyActions() before writing into key_sym_map - CVE-2026-88806 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds write in XkbGetMap reply handling - debian/patches/CVE-2026-88806.patch: check that firstKeyAct + nKeyActs does not exceed max_key_code + 1 in _XkbReadKeyActions() before writing into key_sym_map - CVE-2026-88806

0 tuxcare-debian11-els libx11-6_1.7.2-1+deb11u2+tuxcare.els1_amd64.deb 6f8a36c45faaedb86aa66b61622878fa0820d4c8 libx11-data_1.7.2-1+deb11u2+tuxcare.els1_all.deb 28e0668eda6afd77267d2d3ec391cfba1da6e2e3 libx11-dev_1.7.2-1+deb11u2+tuxcare.els1_amd64.deb 600922ef8d18b7f0ca5f63896d02e93a45390784 libx11-doc_1.7.2-1+deb11u2+tuxcare.els1_all.deb d5832064b15eeb47c4e047964ea5ba0a1ba6f6af libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els1_amd64.deb b7ae35d8d59bef1712e45ee70c809b46cc7c2890 libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els1_amd64.deb 4279e2f800d0f7a7edac93505a924f85eaaef18c libx11-6_1.7.2-1+deb11u2+tuxcare.els1_arm64.deb f5cb31923af754a2dd5ce38658768b513ef55733 libx11-dev_1.7.2-1+deb11u2+tuxcare.els1_arm64.deb a2b323e7ac907826bd619c0bf706a06e91cf1f0a libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els1_arm64.deb c9108d043e5e8de1209851fb6bcd1cb74e4d6498 libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els1_arm64.deb 21e3c34b41b883bd5089d90b96d0ef1df1f17130 libx11-6_1.7.2-1+deb11u2+tuxcare.els1_armel.deb 95a9c88258259911ce3ab75aa36a502b0809cc6f libx11-dev_1.7.2-1+deb11u2+tuxcare.els1_armel.deb c7cef22b4a36a4236439c33bbe0ea22b166916f0 libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els1_armel.deb 453e75821ed124dbda8a8649fc3132e188b24f7e libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els1_armel.deb 7803b86192d121bf5ccf60df443beddb895ee691 CLSA-2026:1791191960 TuxCare License Agreement 0 * SECURITY UPDATE: uninitialised stack data used as the length of a Proxy Protocol v2 header - debian/patches/CVE-2026-94056.patch: repeat the read of the PROXY v2 length field until the complete 16-byte header has arrived, and abort if the peer closes before that, so the header length is never taken from uninitialised stack memory - debian/patches/CVE-2026-94056-2.patch: fail PROXY reads on peer EOF - CVE-2026-94056 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: uninitialised stack data used as the length of a Proxy Protocol v2 header - debian/patches/CVE-2026-94056.patch: repeat the read of the PROXY v2 length field until the complete 16-byte header has arrived, and abort if the peer closes before that, so the header length is never taken from uninitialised stack memory - debian/patches/CVE-2026-94056-2.patch: fail PROXY reads on peer EOF - CVE-2026-94056

0 tuxcare-debian11-els exim4_4.94.2-7+deb11u6+tuxcare.els3_all.deb 8ea95695bcbcb33e4c653ab828c3df08092a790d exim4-base_4.94.2-7+deb11u6+tuxcare.els3_amd64.deb fea0aed892590f7ca4fde3033046f87cd90f8798 exim4-config_4.94.2-7+deb11u6+tuxcare.els3_all.deb 7b2ca259a80f286d0e2b030d77c204dec5ae53df exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els3_amd64.deb aa3c815444ca4afd4a787ec3edc1916132ec91ba exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els3_amd64.deb c271d90c06ce4622cef837594946d6fca5085edf exim4-dev_4.94.2-7+deb11u6+tuxcare.els3_amd64.deb 28dc1157742c400d20da8e0af0c7dfab7d65417d eximon4_4.94.2-7+deb11u6+tuxcare.els3_amd64.deb 591e503fd7f7fcbf289b400a625c1db43b940c01 exim4-base_4.94.2-7+deb11u6+tuxcare.els3_arm64.deb 6fea12b84148059737b8e4820e18ab0c1b616b25 exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els3_arm64.deb 3a6727ff8b8d4210009eb18bcf86a4d5a8ed9d74 exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els3_arm64.deb bc3f43ca440c709b585cd1ad1ed46c23156708c4 exim4-dev_4.94.2-7+deb11u6+tuxcare.els3_arm64.deb d1ea8c8d9fc79239f3826414f7280021d4eb8476 eximon4_4.94.2-7+deb11u6+tuxcare.els3_arm64.deb f14a9c78e0b214f8c25f589d5b0d769d80a6dcea exim4-base_4.94.2-7+deb11u6+tuxcare.els3_armel.deb 3bf8ab50f91a2f69f8ea6e67ff946e1e118d6ffb exim4-daemon-heavy_4.94.2-7+deb11u6+tuxcare.els3_armel.deb 148f14749dff8fc8c728a49cbe1fbd34927610aa exim4-daemon-light_4.94.2-7+deb11u6+tuxcare.els3_armel.deb 262c5e7d78c1c7360a577c1c7755bb563486a9e7 exim4-dev_4.94.2-7+deb11u6+tuxcare.els3_armel.deb bc8f849260befad672d2ec284ae4dce1a6228933 eximon4_4.94.2-7+deb11u6+tuxcare.els3_armel.deb 74e8485db163c694fe133e5edfdf3d78e8e8a5f6 CLSA-2026:1791243820 TuxCare License Agreement 0 * SECURITY UPDATE: invalid memory access when scrolling without valid screen - debian/patches/CVE-2021-3903.patch: invalid memory access when scrolling without valid screen - CVE-2021-3903 * SECURITY UPDATE: reading character past end of line - debian/patches/CVE-2021-3927.patch: reading character past end of line - CVE-2021-3927 * SECURITY UPDATE: crash when using CTRL-W f without finding a file name - debian/patches/CVE-2021-3973.patch: crash when using CTRL-W f without finding a file name - CVE-2021-3973 * SECURITY UPDATE: illegal memory access when C-indenting - debian/patches/CVE-2021-3984.patch: illegal memory access when C-indenting - CVE-2021-3984 * SECURITY UPDATE: using freed memory in open command - debian/patches/CVE-2021-4069.patch: using freed memory in open command - CVE-2021-4069 * SECURITY UPDATE: illegal memory access when using a lambda with an error - debian/patches/CVE-2021-4136.patch: illegal memory access when using a lambda with an error - CVE-2021-4136 * SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: crash when clearing the argument list while using it - CVE-2021-4166 * SECURITY UPDATE: using freed memory with /\%V - debian/patches/CVE-2021-4192.patch: using freed memory with /\%V - CVE-2021-4192 * SECURITY UPDATE: stack corruption when looking for spell suggestions - debian/patches/CVE-2022-0408.patch: stack corruption when looking for spell suggestions - CVE-2022-0408 * SECURITY UPDATE: using freed memory when substitute with function call - debian/patches/CVE-2022-0413.patch: using freed memory when substitute with function call - CVE-2022-0413 * SECURITY UPDATE: using freed memory with :lopen and :bwipe - debian/patches/CVE-2022-0443.patch: using freed memory with :lopen and :bwipe - CVE-2022-0443 * SECURITY UPDATE: may end up with no current buffer - debian/patches/CVE-2022-0554.patch: may end up with no current buffer - CVE-2022-0554 * SECURITY UPDATE: crash when using many composing characters in error message - debian/patches/CVE-2022-0629.patch: crash when using many composing characters in error message - CVE-2022-0629 * SECURITY UPDATE: crash when using special multi-byte character - debian/patches/CVE-2022-0685.patch: crash when using special multi-byte character - CVE-2022-0685 * SECURITY UPDATE: crash with specific regexp pattern and string - debian/patches/CVE-2022-0729.patch: crash with specific regexp pattern and string - CVE-2022-0729 * SECURITY UPDATE: using buffer line after it has been freed - debian/patches/CVE-2022-1154.patch: using buffer line after it has been freed - CVE-2022-1154 * SECURITY UPDATE: NULL pointer access when using invalid pattern - debian/patches/CVE-2022-1620.patch: NULL pointer access when using invalid pattern - CVE-2022-1620 * SECURITY UPDATE: reading past end of line with "gf" in Visual block mode - debian/patches/CVE-2022-1720.patch: reading past end of line with "gf" in Visual block mode - CVE-2022-1720 * SECURITY UPDATE: reading past end of the line when C-indenting - debian/patches/CVE-2022-1733.patch: reading past end of the line when C-indenting - CVE-2022-1733 * SECURITY UPDATE: accessing freed memory when line is flushed - debian/patches/CVE-2022-1796.patch: accessing freed memory when line is flushed - CVE-2022-1796 * SECURITY UPDATE: after text formatting cursor may be in an invalid position - debian/patches/CVE-2022-1851.patch: after text formatting cursor may be in an invalid position - CVE-2022-1851 * SECURITY UPDATE: cursor position may be invalid after "0;" range - debian/patches/CVE-2022-1927.patch: cursor position may be invalid after "0;" range - CVE-2022-1927 * Fix the tests that fail on this branch - debian/patches/fix-Test_arglist_autocmd.patch: adjust Test_arglist_autocmd() for locking the argument list during ":all", per upstream patch 8.2.3885, the test-side companion to 8.2.3884 (CVE-2021-4166) - debian/patches/fix-Test_matchfuzzy.patch: strip the directory from the buffer names before fuzzy-matching, per upstream patch 9.0.0030, so the test no longer depends on the build directory's name Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: invalid memory access when scrolling without valid screen - debian/patches/CVE-2021-3903.patch: invalid memory access when scrolling without valid screen - CVE-2021-3903 * SECURITY UPDATE: reading character past end of line - debian/patches/CVE-2021-3927.patch: reading character past end of line - CVE-2021-3927 * SECURITY UPDATE: crash when using CTRL-W f without finding a file name - debian/patches/CVE-2021-3973.patch: crash when using CTRL-W f without finding a file name - CVE-2021-3973 * SECURITY UPDATE: illegal memory access when C-indenting - debian/patches/CVE-2021-3984.patch: illegal memory access when C-indenting - CVE-2021-3984 * SECURITY UPDATE: using freed memory in open command - debian/patches/CVE-2021-4069.patch: using freed memory in open command - CVE-2021-4069 * SECURITY UPDATE: illegal memory access when using a lambda with an error - debian/patches/CVE-2021-4136.patch: illegal memory access when using a lambda with an error - CVE-2021-4136 * SECURITY UPDATE: crash when clearing the argument list while using it - debian/patches/CVE-2021-4166.patch: crash when clearing the argument list while using it - CVE-2021-4166 * SECURITY UPDATE: using freed memory with /\%V - debian/patches/CVE-2021-4192.patch: using freed memory with /\%V - CVE-2021-4192 * SECURITY UPDATE: stack corruption when looking for spell suggestions - debian/patches/CVE-2022-0408.patch: stack corruption when looking for spell suggestions - CVE-2022-0408 * SECURITY UPDATE: using freed memory when substitute with function call - debian/patches/CVE-2022-0413.patch: using freed memory when substitute with function call - CVE-2022-0413 * SECURITY UPDATE: using freed memory with :lopen and :bwipe - debian/patches/CVE-2022-0443.patch: using freed memory with :lopen and :bwipe - CVE-2022-0443 * SECURITY UPDATE: may end up with no current buffer - debian/patches/CVE-2022-0554.patch: may end up with no current buffer - CVE-2022-0554 * SECURITY UPDATE: crash when using many composing characters in error message - debian/patches/CVE-2022-0629.patch: crash when using many composing characters in error message - CVE-2022-0629 * SECURITY UPDATE: crash when using special multi-byte character - debian/patches/CVE-2022-0685.patch: crash when using special multi-byte character - CVE-2022-0685 * SECURITY UPDATE: crash with specific regexp pattern and string - debian/patches/CVE-2022-0729.patch: crash with specific regexp pattern and string - CVE-2022-0729 * SECURITY UPDATE: using buffer line after it has been freed - debian/patches/CVE-2022-1154.patch: using buffer line after it has been freed - CVE-2022-1154 * SECURITY UPDATE: NULL pointer access when using invalid pattern - debian/patches/CVE-2022-1620.patch: NULL pointer access when using invalid pattern - CVE-2022-1620 * SECURITY UPDATE: reading past end of line with "gf" in Visual block mode - debian/patches/CVE-2022-1720.patch: reading past end of line with "gf" in Visual block mode - CVE-2022-1720 * SECURITY UPDATE: reading past end of the line when C-indenting - debian/patches/CVE-2022-1733.patch: reading past end of the line when C-indenting - CVE-2022-1733 * SECURITY UPDATE: accessing freed memory when line is flushed - debian/patches/CVE-2022-1796.patch: accessing freed memory when line is flushed - CVE-2022-1796 * SECURITY UPDATE: after text formatting cursor may be in an invalid position - debian/patches/CVE-2022-1851.patch: after text formatting cursor may be in an invalid position - CVE-2022-1851 * SECURITY UPDATE: cursor position may be invalid after "0;" range - debian/patches/CVE-2022-1927.patch: cursor position may be invalid after "0;" range - CVE-2022-1927 * Fix the tests that fail on this branch - debian/patches/fix-Test_arglist_autocmd.patch: adjust Test_arglist_autocmd() for locking the argument list during ":all", per upstream patch 8.2.3885, the test-side companion to 8.2.3884 (CVE-2021-4166) - debian/patches/fix-Test_matchfuzzy.patch: strip the directory from the buffer names before fuzzy-matching, per upstream patch 9.0.0030, so the test no longer depends on the build directory's name

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb 56f93616014c7b100e6d9d96aad4c7c5ecc5de40 vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb 4538ba7ebccbce4150a2f59d961b2b3555857354 vim-common_8.2.2434-3+deb11u3+tuxcare.els15_all.deb 5353d40ca2da7004fd4fecbf77582a5430206284 vim-doc_8.2.2434-3+deb11u3+tuxcare.els15_all.deb 0163de932d8574ac34c832b70dcfb166ec9b92e0 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els15_all.deb 7d642528b4eab5efe398debdedb25f93b6737388 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb 7efedbce023d5843ae6e8153a2de7fbb5d011359 vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els15_all.deb 15446d8b6ccb5d1a3f9e4fb9eeb457518ec0c148 vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb 0a73d91627e4dde30398cd242390aa3657d141e7 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els15_all.deb f65f0d81494b0df160ea796139a0c37703d692aa vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb ca01d7803ae1c78d739fe880fb78963ea88f475b xxd_8.2.2434-3+deb11u3+tuxcare.els15_amd64.deb 463cc1e23dbbfe580090d2b78b19b8223a603ec5 vim_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb dabd326bdacc7506849c1758c8bc8c0cca7a50e4 vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb 6bdcf930a42eea4f93279ab76d764b8fbcd5fc3b vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb 79765e59fa75a23c41b6cd0b3fcf5c31d0ca83f3 vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb 9a52ff116cd7e1aaa04d854c3a8ea7f09355a3d6 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb d85212e5aca9e8a123e42f98eaf2188912a18758 xxd_8.2.2434-3+deb11u3+tuxcare.els15_arm64.deb 38eda9112a4e2ec2f4bb73a033808f5515f7758a vim_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb edaad527d64880d4d17eadcd5b149b427ad608d6 vim-athena_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb 3c934f8e0b788c98c866648d28ddcb87125410d4 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb feb2b66aff5d6bcd28ad27252f49861bfbc13a31 vim-nox_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb dca57464db9c081d37c57788b66d16b05c5295ac vim-tiny_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb 66c5823c642e0691f2fc57419c23b179832e6e2d xxd_8.2.2434-3+deb11u3+tuxcare.els15_armel.deb 1865fb57b99faaab6e49404231512584871abc75 CLSA-2026:1791276920 TuxCare License Agreement 0 * SECURITY UPDATE: double free in CalDAV VPATCH BYPARAM handling - debian/patches/CVE-2026-61915-pre.patch: do not free the PATCH-ACTION parameter already freed by icalproperty_remove_parameter_by_ref() - debian/patches/CVE-2026-61915.patch: free the BYPARAM selector once after the property loop in apply_property_updates() - debian/patches/CVE-2026-61915-test.patch: add cunit regression test - CVE-2026-61915 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: double free in CalDAV VPATCH BYPARAM handling - debian/patches/CVE-2026-61915-pre.patch: do not free the PATCH-ACTION parameter already freed by icalproperty_remove_parameter_by_ref() - debian/patches/CVE-2026-61915.patch: free the BYPARAM selector once after the property loop in apply_property_updates() - debian/patches/CVE-2026-61915-test.patch: add cunit regression test - CVE-2026-61915

0 tuxcare-debian11-els cyrus-admin_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 3c5d3e693f63c20f253aa0e9653640ed5ccecade cyrus-caldav_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb fa42c51455fc78606c6366ee166b96d62fea10f3 cyrus-clients_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 81c55984aae9b0da5edddbde4c3c8751cab88679 cyrus-common_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 7bddd2e4f0c59d9a0e5adb9aab958bc3835842f6 cyrus-dev_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 981b150e12271610c44673a030fee5d97d04ec1e cyrus-doc_3.2.6-2+deb11u4+tuxcare.els1_all.deb caf475875d53de14bc3042fec6eb0f3fa805741b cyrus-imapd_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 30fff114ff0cf3ae4167ca11409dce2dc294e19c cyrus-murder_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 5aa5bf2bd21ca57788e042be5e4525c86458f9a3 cyrus-nntpd_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb b723832d5fc2c6ce7604b08ef878965600c6e606 cyrus-pop3d_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 8326519896e01958dbd6a46f5134b0ca835566b5 cyrus-replication_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 6ec6743b7192c6d5be8c6b80960f5eabff14fb62 libcyrus-imap-perl_3.2.6-2+deb11u4+tuxcare.els1_amd64.deb 3f60678cbd80acee743cedd31734b8e03f41621e cyrus-admin_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 687f6bcdcdf26b859b487cf5d3feeb17914418f3 cyrus-caldav_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb a697cb59250611b5da2c5172d74ff52e94593575 cyrus-clients_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 12dcd311bfedd168dafcaf8d1a6a41ae460e8666 cyrus-common_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb c46bec0d6b8808a6af508e71855bed8583d5a167 cyrus-dev_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb a99799ea6f4047105550906f7f6b4f2ba7eb57f0 cyrus-imapd_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb a32b6f75821141b800edbf354ae8a9636ef96952 cyrus-murder_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 6be6f9b1ddfc67db327521d6401a1fe66db86489 cyrus-nntpd_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb af2d2cc347cfc95bcd98c5a3f60546d043a9fdd0 cyrus-pop3d_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 180c01c4693e70e1c1e64e7a8463a9757bb21dd4 cyrus-replication_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 0a83e0d30c1e442d0ddda910b6da6d7d721a17b6 libcyrus-imap-perl_3.2.6-2+deb11u4+tuxcare.els1_arm64.deb 37862ea95ca2fd51c002fea3afed3e632d49d0f2 cyrus-admin_3.2.6-2+deb11u4+tuxcare.els1_armel.deb db243162e47be917b612f35dff93cb48e4319b77 cyrus-caldav_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 396f12b4e044146fe98d9fbec0dc4b3d81225fe1 cyrus-clients_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 01874f0de9e54f001e0bf41dec1a9284221555b5 cyrus-common_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 295ac66a59a6e41092375c152bd860b3509c3dde cyrus-dev_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 4341a131560f58c0364185103abc6c164bc9f0a6 cyrus-imapd_3.2.6-2+deb11u4+tuxcare.els1_armel.deb c8727e6d7b3d4283345da98a967b1d59ecfc19e2 cyrus-murder_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 18870355c548ab71d0ba92ad10fc3df79603eee0 cyrus-nntpd_3.2.6-2+deb11u4+tuxcare.els1_armel.deb f1c1f8389e31c80f2e645e314a5cd1c37ab71022 cyrus-pop3d_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 1fdc4d2d5348069786b419f61214b79c70a50349 cyrus-replication_3.2.6-2+deb11u4+tuxcare.els1_armel.deb 533da8497269c7c53c5daa88d365d0d4d71e550e libcyrus-imap-perl_3.2.6-2+deb11u4+tuxcare.els1_armel.deb b7bdbda3e21593a5de47e7c23de1d65bafb36b93 CLSA-2026:1791334139 TuxCare License Agreement 0 * SECURITY UPDATE: using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: using uninitialized value and freed memory in spell command - CVE-2022-2042 * SECURITY UPDATE: invalid memory access when using expression on command line - debian/patches/CVE-2022-2175.patch: invalid memory access when using expression on command line - CVE-2022-2175 * SECURITY UPDATE: reading before the start of the line with BS in Replace mode - debian/patches/CVE-2022-2207.patch: reading before the start of the line with BS in Replace mode - CVE-2022-2207 * SECURITY UPDATE: invalid memory access after diff buffer manipulations - debian/patches/CVE-2022-2210.patch: invalid memory access after diff buffer manipulations - CVE-2022-2210 * SECURITY UPDATE: reading beyond the end of the line with put command - debian/patches/CVE-2022-2264.patch: reading beyond the end of the line with put command - CVE-2022-2264 * SECURITY UPDATE: accessing memory beyond the end of the line - debian/patches/CVE-2022-2284.patch: accessing memory beyond the end of the line - CVE-2022-2284 * SECURITY UPDATE: going over the end of the typahead - debian/patches/CVE-2022-2285.patch: going over the end of the typahead - CVE-2022-2285 * SECURITY UPDATE: invalid memory access when adding word to spell word list - debian/patches/CVE-2022-2287.patch: invalid memory access when adding word to spell word list - CVE-2022-2287 * SECURITY UPDATE: accessing freed memory with diff put - debian/patches/CVE-2022-2289.patch: accessing freed memory with diff put - CVE-2022-2289 * SECURITY UPDATE: reading past end of completion with duplicate match - debian/patches/CVE-2022-2344.patch: reading past end of completion with duplicate match - CVE-2022-2344 * SECURITY UPDATE: using freed memory with recursive substitute - debian/patches/CVE-2022-2345.patch: using freed memory with recursive substitute - CVE-2022-2345 * SECURITY UPDATE: reading past end of line with insert mode completion - debian/patches/CVE-2022-2571.patch: reading past end of line with insert mode completion - CVE-2022-2571 * SECURITY UPDATE: invalid memory access when compiling :unlet - debian/patches/CVE-2022-2816.patch: invalid memory access when compiling :unlet - CVE-2022-2816 * SECURITY UPDATE: reading before the start of the line - debian/patches/CVE-2022-2845.patch: reading before the start of the line - CVE-2022-2845 * SECURITY UPDATE: using freed memory with multiple line breaks in expression - debian/patches/CVE-2022-2889.patch: using freed memory with multiple line breaks in expression - CVE-2022-2889 * SECURITY UPDATE: using freed memory when 'tagfunc' deletes the buffer - debian/patches/CVE-2022-2946.patch: using freed memory when 'tagfunc' deletes the buffer - CVE-2022-2946 * SECURITY UPDATE: using freed memory when using 'quickfixtextfunc' recursively - debian/patches/CVE-2022-2982.patch: using freed memory when using 'quickfixtextfunc' recursively - CVE-2022-2982 * SECURITY UPDATE: using freed memory when location list changed in autocmd - debian/patches/CVE-2022-3016.patch: using freed memory when location list changed in autocmd - CVE-2022-3016 * SECURITY UPDATE: crash when no errors and 'quickfixtextfunc' is set - debian/patches/CVE-2022-3037.patch: crash when no errors and 'quickfixtextfunc' is set - CVE-2022-3037 * SECURITY UPDATE: illegal memory access when replacing in virtualedit mode - debian/patches/CVE-2022-3234.patch: illegal memory access when replacing in virtualedit mode - CVE-2022-3234 * SECURITY UPDATE: using freed memory with cmdwin and BufEnter autocmd - debian/patches/CVE-2022-3235.patch: using freed memory with cmdwin and BufEnter autocmd - CVE-2022-3235 * SECURITY UPDATE: dummy buffer ends up in a window - debian/patches/CVE-2022-3591.patch: dummy buffer ends up in a window - CVE-2022-3591 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: using uninitialized value and freed memory in spell command - debian/patches/CVE-2022-2042.patch: using uninitialized value and freed memory in spell command - CVE-2022-2042 * SECURITY UPDATE: invalid memory access when using expression on command line - debian/patches/CVE-2022-2175.patch: invalid memory access when using expression on command line - CVE-2022-2175 * SECURITY UPDATE: reading before the start of the line with BS in Replace mode - debian/patches/CVE-2022-2207.patch: reading before the start of the line with BS in Replace mode - CVE-2022-2207 * SECURITY UPDATE: invalid memory access after diff buffer manipulations - debian/patches/CVE-2022-2210.patch: invalid memory access after diff buffer manipulations - CVE-2022-2210 * SECURITY UPDATE: reading beyond the end of the line with put command - debian/patches/CVE-2022-2264.patch: reading beyond the end of the line with put command - CVE-2022-2264 * SECURITY UPDATE: accessing memory beyond the end of the line - debian/patches/CVE-2022-2284.patch: accessing memory beyond the end of the line - CVE-2022-2284 * SECURITY UPDATE: going over the end of the typahead - debian/patches/CVE-2022-2285.patch: going over the end of the typahead - CVE-2022-2285 * SECURITY UPDATE: invalid memory access when adding word to spell word list - debian/patches/CVE-2022-2287.patch: invalid memory access when adding word to spell word list - CVE-2022-2287 * SECURITY UPDATE: accessing freed memory with diff put - debian/patches/CVE-2022-2289.patch: accessing freed memory with diff put - CVE-2022-2289 * SECURITY UPDATE: reading past end of completion with duplicate match - debian/patches/CVE-2022-2344.patch: reading past end of completion with duplicate match - CVE-2022-2344 * SECURITY UPDATE: using freed memory with recursive substitute - debian/patches/CVE-2022-2345.patch: using freed memory with recursive substitute - CVE-2022-2345 * SECURITY UPDATE: reading past end of line with insert mode completion - debian/patches/CVE-2022-2571.patch: reading past end of line with insert mode completion - CVE-2022-2571 * SECURITY UPDATE: invalid memory access when compiling :unlet - debian/patches/CVE-2022-2816.patch: invalid memory access when compiling :unlet - CVE-2022-2816 * SECURITY UPDATE: reading before the start of the line - debian/patches/CVE-2022-2845.patch: reading before the start of the line - CVE-2022-2845 * SECURITY UPDATE: using freed memory with multiple line breaks in expression - debian/patches/CVE-2022-2889.patch: using freed memory with multiple line breaks in expression - CVE-2022-2889 * SECURITY UPDATE: using freed memory when 'tagfunc' deletes the buffer - debian/patches/CVE-2022-2946.patch: using freed memory when 'tagfunc' deletes the buffer - CVE-2022-2946 * SECURITY UPDATE: using freed memory when using 'quickfixtextfunc' recursively - debian/patches/CVE-2022-2982.patch: using freed memory when using 'quickfixtextfunc' recursively - CVE-2022-2982 * SECURITY UPDATE: using freed memory when location list changed in autocmd - debian/patches/CVE-2022-3016.patch: using freed memory when location list changed in autocmd - CVE-2022-3016 * SECURITY UPDATE: crash when no errors and 'quickfixtextfunc' is set - debian/patches/CVE-2022-3037.patch: crash when no errors and 'quickfixtextfunc' is set - CVE-2022-3037 * SECURITY UPDATE: illegal memory access when replacing in virtualedit mode - debian/patches/CVE-2022-3234.patch: illegal memory access when replacing in virtualedit mode - CVE-2022-3234 * SECURITY UPDATE: using freed memory with cmdwin and BufEnter autocmd - debian/patches/CVE-2022-3235.patch: using freed memory with cmdwin and BufEnter autocmd - CVE-2022-3235 * SECURITY UPDATE: dummy buffer ends up in a window - debian/patches/CVE-2022-3591.patch: dummy buffer ends up in a window - CVE-2022-3591

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb ee7dc96d2a0b62e04d3c9a6463221f4f20b3332a vim-athena_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb 7052aa9b5ac05c2afc0056735c95e501acc77ca6 vim-common_8.2.2434-3+deb11u3+tuxcare.els16_all.deb 0e21ad29ca4ec14cd34989b4e87e8bffc4ef67b3 vim-doc_8.2.2434-3+deb11u3+tuxcare.els16_all.deb c82790a807fb9534b9e4d2e6fea3657630d02fbe vim-gtk_8.2.2434-3+deb11u3+tuxcare.els16_all.deb 7e4a54c25b90fafd6b166a7e8d179a825930ff7c vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb 4a8b8558b8dbab5f279f247ca5a6a4b20fad1740 vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els16_all.deb 26aa7a3e023709615b9de1c1dcd18c900e077952 vim-nox_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb 4e5a1607e0db657f221fa33f5ecf1cdfb7d560b8 vim-runtime_8.2.2434-3+deb11u3+tuxcare.els16_all.deb 08175cc24970d1aede4757035c2699516bdcd434 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb 22ec7899ed56ebf7b09b98f9a31732ddc2c45cce xxd_8.2.2434-3+deb11u3+tuxcare.els16_amd64.deb 9c3ceb191dc06910dce9fb896d33ad548b1b8eb6 vim_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb 6f2a376bc0565d5dedcf54ccc5891ea2b5820340 vim-athena_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb 538f93335b60b6282a5153175bb0c81ff8c3cb1b vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb a218cf8cf2f8a5b0375071f3a26cd1e32af0ec9c vim-nox_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb 8105cf77c5577532445e05dda5e2aa8ee45cec26 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb 82a8b5dbefde5a44d1170fc1d0952b702ce44aef xxd_8.2.2434-3+deb11u3+tuxcare.els16_arm64.deb 6d61cec141fe19bf22801b6231b9748f2d416c91 vim_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb 2921e04ed1d06b5ff164ab4bd8d71588b0f39e73 vim-athena_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb 9d41e17860561e64d470d6126037b90d49a0c9f3 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb fe1bfa3e48fc0b9b21d87ab543778ff4ec5564fa vim-nox_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb 9d353a60f0a243a2e6abe54967737fa8a9d42794 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb 9f52125d15f87b122f6e54913fa65e16e3cc9504 xxd_8.2.2434-3+deb11u3+tuxcare.els16_armel.deb b4ebb85488788b984cffdcd9543adc4b4d2b1390 CLSA-2026:1791334395 TuxCare License Agreement 0 * SECURITY UPDATE: local privilege escalation via the cifs.upcall getpwuid() lookup in the caller-controlled namespace - debian/patches/CVE-2026-12505.patch: in cifs.upcall.c, drop supplementary groups before decoding the spnego key, call getpwuid() while still on the host namespace instead of after switch_to_process_ns(), and translate the host UID/GID to the target user namespace by parsing /proc/<pid>/{uid,gid}_map numerically. - CVE-2026-12505 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: local privilege escalation via the cifs.upcall getpwuid() lookup in the caller-controlled namespace - debian/patches/CVE-2026-12505.patch: in cifs.upcall.c, drop supplementary groups before decoding the spnego key, call getpwuid() while still on the host namespace instead of after switch_to_process_ns(), and translate the host UID/GID to the target user namespace by parsing /proc/<pid>/{uid,gid}_map numerically. - CVE-2026-12505

0 tuxcare-debian11-els cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_amd64.deb 7c5172cdc6140ab64a377cc5ab4b14b5af35905a cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_arm64.deb fb8d3471a75d2df780b802aa537764776bc31432 cifs-utils_6.11-3.1+deb11u2+tuxcare.els1_armel.deb c98ae60488af41635b0696968bd37e25c748f52f CLSA-2026:1791374307 TuxCare License Agreement 0 * SECURITY UPDATE: Use-after-free via gettext command left registered after module unload - debian/patches/CVE-2025-61662.patch: unregister the gettext command in GRUB_MOD_FINI() - CVE-2025-61662 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Use-after-free via gettext command left registered after module unload - debian/patches/CVE-2025-61662.patch: unregister the gettext command in GRUB_MOD_FINI() - CVE-2025-61662

0 tuxcare-debian11-els grub-common_2.06-3~deb11u7+tuxcare.els1_amd64.deb b64e0c6e1debc8146af7807d5bad8383f33ebd1b grub-coreboot_2.06-3~deb11u7+tuxcare.els1_amd64.deb 20b311861dc39088104f57722f3ca8bfdc56c834 grub-coreboot-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb 8b1cfc5885fd342ae280430b5e8c96150d4fe1ef grub-efi_2.06-3~deb11u7+tuxcare.els1_amd64.deb e9dd4298ceb83cdb95c858dc0d980e0d93bfe6ec grub-efi-amd64_2.06-3~deb11u7+tuxcare.els1_amd64.deb 366d2a9496b454fb81ac0587d0546a03761383ba grub-efi-amd64-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb 7e94edc9f64fc695d0eb44e3df10c912f6962ef4 grub-efi-amd64-signed-template_2.06-3~deb11u7+tuxcare.els1_amd64.deb 1214ab263b72d52f104da492a0b5bdeaaf20c19e grub-efi-ia32_2.06-3~deb11u7+tuxcare.els1_amd64.deb 976778253bdd2244171d4824e73e7041ba6c4924 grub-efi-ia32-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb 4584ac6ba0fd1ce3fc7539dda40dbdf8903ec457 grub-emu_2.06-3~deb11u7+tuxcare.els1_amd64.deb 1a2944c3c39262c84688b8b2fd4ce92c9f3c6ebb grub-firmware-qemu_2.06-3~deb11u7+tuxcare.els1_amd64.deb e18a11849fc52163fb2cc3f6399363224bdf530b grub-ieee1275_2.06-3~deb11u7+tuxcare.els1_amd64.deb 82f649fa06cabfcd7a315e789feca0b4a6d226fb grub-ieee1275-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb dbf8621c398275286fe790b4c2da4719679af4bf grub-linuxbios_2.06-3~deb11u7+tuxcare.els1_amd64.deb fa98e16f658b2edc4cd48d21cd07d5ac28f251e0 grub-pc_2.06-3~deb11u7+tuxcare.els1_amd64.deb 6bacd83d2db255c3cba3cecf61f159fd15f90cc5 grub-pc-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb 81f8dd53691ca6254d3d13761fc62273ac352ad5 grub-rescue-pc_2.06-3~deb11u7+tuxcare.els1_amd64.deb c40afbf0cddb2e9ad525268bc9ad854e627eaab6 grub-theme-starfield_2.06-3~deb11u7+tuxcare.els1_amd64.deb a0ec3f2f21a327b2f47cdf51af16cd3574557de1 grub-xen_2.06-3~deb11u7+tuxcare.els1_amd64.deb 3a453132b9a8ca1e7f8d2b7618e777bde1b34f6e grub-xen-bin_2.06-3~deb11u7+tuxcare.els1_amd64.deb 91b4510ea80452b4f30d0399e8e6b74f7fe2ad02 grub-xen-host_2.06-3~deb11u7+tuxcare.els1_amd64.deb 55b9340d4d55d58ce4c7086e115dc20cede6ada0 grub2_2.06-3~deb11u7+tuxcare.els1_amd64.deb 4f3cf1f69c53b06abef9f8d17727f905df4502fe grub2-common_2.06-3~deb11u7+tuxcare.els1_amd64.deb b9352141339e43d39c432fb1cac68abdc679afe4 grub-common_2.06-3~deb11u7+tuxcare.els1_arm64.deb 01870b738b5bb47dd3b4b9806354ff4de3976ab6 grub-efi_2.06-3~deb11u7+tuxcare.els1_arm64.deb 66ba2bcbadc64927f40e033b62782418bdcbb660 grub-efi-arm64_2.06-3~deb11u7+tuxcare.els1_arm64.deb 42ccccde3c10cdd50b89226a24db115fd3297b6d grub-efi-arm64-bin_2.06-3~deb11u7+tuxcare.els1_arm64.deb d24f267064d71cc5bc1ba1afef8997e4f8eb915c grub-efi-arm64-signed-template_2.06-3~deb11u7+tuxcare.els1_arm64.deb 913f0aa1fd7303c46ee943732466fa931be1269b grub-theme-starfield_2.06-3~deb11u7+tuxcare.els1_arm64.deb 1e3ff898c680773ae492a12451a97c2d8b1656ca grub2-common_2.06-3~deb11u7+tuxcare.els1_arm64.deb c603d2f46f6e451ddea42dcba1c6c915232177fb grub-common_2.06-3~deb11u7+tuxcare.els1_armel.deb d26768f378a1bdada67c67adc9b67d96af13f369 grub-efi_2.06-3~deb11u7+tuxcare.els1_armel.deb 5e7d680beb2b1217c35db74eea67ffb3fe4e9528 grub-efi-arm_2.06-3~deb11u7+tuxcare.els1_armel.deb 5ec5e0cbee68bd99469399dbd2545074d0ff57fd grub-efi-arm-bin_2.06-3~deb11u7+tuxcare.els1_armel.deb 2f9b879a3c72fd1917531931fcb4ebf2a693abfa grub-theme-starfield_2.06-3~deb11u7+tuxcare.els1_armel.deb 6ef613f8c0c48b5279cd34343a26d0dc4193bd03 grub-uboot_2.06-3~deb11u7+tuxcare.els1_armel.deb 185f1763da6e2438460f300443fb63c6bcf5b475 grub-uboot-bin_2.06-3~deb11u7+tuxcare.els1_armel.deb 6b5d2f78f67b95a8971381f2349520bd92db28c5 grub2-common_2.06-3~deb11u7+tuxcare.els1_armel.deb 352dd5e2195d5fd50fd0a5f8e96b6b62df81b851 CLSA-2026:1791399705 TuxCare License Agreement 0 * SECURITY UPDATE: use-after-free via HTTP/2 pushed transfer not inheriting the parent share - debian/patches/CVE-2026-18924.patch: make a server-pushed transfer inherit the share of the easy handle it was cloned from in lib/http2.c, so it uses the same connection pool as its parent - CVE-2026-18924 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: use-after-free via HTTP/2 pushed transfer not inheriting the parent share - debian/patches/CVE-2026-18924.patch: make a server-pushed transfer inherit the share of the easy handle it was cloned from in lib/http2.c, so it uses the same connection pool as its parent - CVE-2026-18924

0 tuxcare-debian11-els curl_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb 53228db525b94218cd41bebdd642ef86068c1d22 libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb 079ca5218034e454af279015cf2db69d13afe2d3 libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb 8e85724617ccda2b635beca3767452803d75e224 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb e4ccac634528fca88e21cf0fa9494794bb1dac70 libcurl4-doc_7.74.0-1.3+deb11u16+tuxcare.els2_all.deb ce8ae61b43458aedd665f91482502fa6bf203a7b libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb 5da38bc4e0eff722201139af7432b97e951ab988 libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb dd0a9040d2931a30ee37a9c1b744e5614fb05651 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els2_amd64.deb c21caf1a250e1f86722b894e5b44f3beb33b4bd1 curl_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb 96b180beae850c7e6e9c0d5cfccf394672fd7708 libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb 78d71e6c5a8f8dd65e0d89f8b434d89cc68c388c libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb 473dbe34333b931dce33103434d0756258edd326 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb 303444d0af0daecf5ee53c2974a4beb41c0e39a9 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb ae5e9d4197bb9a2ef6e51693273aee2d72dcfd0c libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb b3071eba1f61eb47447b22075054ef636dccdeb0 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els2_arm64.deb 73708de515384a9ad8ac21dc3a4a0db5452e9ddf curl_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb 4d6522f197ac338707ef7fcfc7273aa4fd4724bc libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb b55412d8d50e43e5d3ddec38afa4c6e418d71b46 libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb fe909cd60add6c04cb98934efda7311bb309c257 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb 2158f129a1d4c45d446a371e1d298b6c4f38d60d libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb 9f427893c62c83389faced4be44a024ab358a3ed libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb 4bbcd660c6cdf8d69baa6e4416986a6cd2764737 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els2_armel.deb f80ca4a9ede73885f41589c918382107328bcbd5 CLSA-2026:1791486841 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds write in JIT matching with a growable JIT stack, because the stack-resize stub grew the stack by a fixed 8192 bytes even when a single frame allocation was larger than that - debian/patches/CVE-2026-103111.patch: grow the JIT stack far enough to cover large single allocations in src/pcre2_jit_compile.c - CVE-2026-103111 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds write in JIT matching with a growable JIT stack, because the stack-resize stub grew the stack by a fixed 8192 bytes even when a single frame allocation was larger than that - debian/patches/CVE-2026-103111.patch: grow the JIT stack far enough to cover large single allocations in src/pcre2_jit_compile.c - CVE-2026-103111

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els6_amd64.deb 52f3679be1417000c9947ee21d2c4a08f95580b6 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els6_amd64.deb 9a8cb663e1abcafbe4ca3bde62e7c875dea99308 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els6_amd64.deb 167a7d0d6d6348a1a140a04b6a8791766bf52a4e libpcre2-dev_10.36-2+deb11u1+tuxcare.els6_amd64.deb d48d3ab6cbbfaff24a0121d90530f192a3d1c7f0 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els6_amd64.deb 581510175a73dec62c174d5871ebc8f88fb305fc pcre2-utils_10.36-2+deb11u1+tuxcare.els6_amd64.deb 2953bf9a4b617466002244539b4e7276f43ac6f5 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els6_arm64.deb 0cf31103816b7fe85cee2fb68e93d536bd991d6a libpcre2-32-0_10.36-2+deb11u1+tuxcare.els6_arm64.deb 45352d8b0caaa11315ea1e9b5dffd625c755ae11 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els6_arm64.deb cea844c5bbc29e2e99ade901eb883feeb677a6db libpcre2-dev_10.36-2+deb11u1+tuxcare.els6_arm64.deb f401b857d2426ec35a437f535e5920f5cc26bfeb libpcre2-posix2_10.36-2+deb11u1+tuxcare.els6_arm64.deb 355a3c30ff535185750889022a2b741ccaf9afb1 pcre2-utils_10.36-2+deb11u1+tuxcare.els6_arm64.deb 07294e08a2b4fbe04ce37583fd143a54ca7e47f0 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els6_armel.deb efa1ce0dba5c5696f5dceab6df04834b537e4079 libpcre2-32-0_10.36-2+deb11u1+tuxcare.els6_armel.deb 0359ba0eda2e86958726e4a877a132347bd827f8 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els6_armel.deb 247192aac5a9c670760081143a4bbd261e651b10 libpcre2-dev_10.36-2+deb11u1+tuxcare.els6_armel.deb 30fb5d850d5eee10b6b852cc7a57581869ac5ff0 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els6_armel.deb 3f6262b8db23cc98dfc347ade946e8f9f603ca5e pcre2-utils_10.36-2+deb11u1+tuxcare.els6_armel.deb a1910d54e578c10e785d36e4885b537f438ee9ea CLSA-2026:1791489887 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds read in XIM trigger-key registration - debian/patches/CVE-2026-94284.patch: pass the remaining payload length to _XimRegisterTriggerkey() and reject on-keys/off-keys lengths that do not fit before copying - CVE-2026-94284 * SECURITY UPDATE: out-of-bounds read in byte-oriented codeset parsing - debian/patches/CVE-2026-94285.patch: pass the remaining input length to byteM_parse_codeset() and skip codesets longer than the available bytes - CVE-2026-94285 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds read in XIM trigger-key registration - debian/patches/CVE-2026-94284.patch: pass the remaining payload length to _XimRegisterTriggerkey() and reject on-keys/off-keys lengths that do not fit before copying - CVE-2026-94284 * SECURITY UPDATE: out-of-bounds read in byte-oriented codeset parsing - debian/patches/CVE-2026-94285.patch: pass the remaining input length to byteM_parse_codeset() and skip codesets longer than the available bytes - CVE-2026-94285

0 tuxcare-debian11-els libx11-6_1.7.2-1+deb11u2+tuxcare.els2_amd64.deb 7a28806edbc59d4d4236f949cde194155df255cb libx11-data_1.7.2-1+deb11u2+tuxcare.els2_all.deb 31605d890f6d91a4ea2e1d2478ebe305a9f93c0e libx11-dev_1.7.2-1+deb11u2+tuxcare.els2_amd64.deb a87f4b5f2454daf32aa8eb23f4c39b037ec34582 libx11-doc_1.7.2-1+deb11u2+tuxcare.els2_all.deb dd91e347afcff1c34c372245180cede661f6671c libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els2_amd64.deb 66d502f988ec14eb4ac0444a7d852af993a40b3f libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els2_amd64.deb f460ed74d33ee4dd21f616c1540f14a1194e4e5b libx11-6_1.7.2-1+deb11u2+tuxcare.els2_arm64.deb 2a28f3f58634542fc5ae62fe03b03dcad3a6ec66 libx11-dev_1.7.2-1+deb11u2+tuxcare.els2_arm64.deb 7f282d57a81e239a92c6938586c7503463513472 libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els2_arm64.deb 192aadf835143c598aa9c71bf1837d62580c4b65 libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els2_arm64.deb 5bb1606b5915f2362a62c989ae0495824fe2b8f7 libx11-6_1.7.2-1+deb11u2+tuxcare.els2_armel.deb 3dfec943d0c44a081496ae99d9020ca78d0069f8 libx11-dev_1.7.2-1+deb11u2+tuxcare.els2_armel.deb f542e23e1c4fc94b032be73f2d312afdd425a59b libx11-xcb-dev_1.7.2-1+deb11u2+tuxcare.els2_armel.deb e7685291c8048416700496028e553685e8c95d06 libx11-xcb1_1.7.2-1+deb11u2+tuxcare.els2_armel.deb 627d7ed61da45d11b93e4c688f11ac3d297b83a6 CLSA-2026:1791490073 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer overflow after a failed write - debian/patches/CVE-2026-76844.patch: in gzwrite.c reset strm.next_in/avail_in when gz_comp() fails in gz_write(). - CVE-2026-76844 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer overflow after a failed write - debian/patches/CVE-2026-76844.patch: in gzwrite.c reset strm.next_in/avail_in when gz_comp() fails in gz_write(). - CVE-2026-76844

0 tuxcare-debian11-els lib32z1_1.2.11.dfsg-2+deb11u2+tuxcare.els1_amd64.deb 90689fd085436bb99478339f9580b918311badf8 lib32z1-dev_1.2.11.dfsg-2+deb11u2+tuxcare.els1_amd64.deb d2e452e2d11b56b643e1f7fe2eaf6b13200bac59 zlib1g_1.2.11.dfsg-2+deb11u2+tuxcare.els1_amd64.deb f2bb0dfe493b7643b35abb09b36a48e629619e60 zlib1g-dev_1.2.11.dfsg-2+deb11u2+tuxcare.els1_amd64.deb 7864b500b27ad58e87a0c1e62f19e5b6d7a1cd0b zlib1g_1.2.11.dfsg-2+deb11u2+tuxcare.els1_arm64.deb 4e725f4f4a2a3f92fd9e9a6b8b6deb53889e4771 zlib1g-dev_1.2.11.dfsg-2+deb11u2+tuxcare.els1_arm64.deb 19ac90b7f23f5da6169619876f946e7f3f462c2e zlib1g_1.2.11.dfsg-2+deb11u2+tuxcare.els1_armel.deb d1ef72275dc5e1c1a2a281d0091bdf80668b0d9b zlib1g-dev_1.2.11.dfsg-2+deb11u2+tuxcare.els1_armel.deb 53b4bc8871a1f3f110b07e74bae2e4408a41843d CLSA-2026:1791490435 TuxCare License Agreement 0 * SECURITY UPDATE: DTLS retransmits handshake messages from a stale buffer offset - debian/patches/CVE-2026-84782.patch: DTLS retransmits handshake messages from a stale buffer offset - CVE-2026-84782 * SECURITY UPDATE: Excessive memory allocation from relative CRL distribution point names - debian/patches/CVE-2026-35189.patch: Excessive memory allocation from relative CRL distribution point names - CVE-2026-35189 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: DTLS retransmits handshake messages from a stale buffer offset - debian/patches/CVE-2026-84782.patch: DTLS retransmits handshake messages from a stale buffer offset - CVE-2026-84782 * SECURITY UPDATE: Excessive memory allocation from relative CRL distribution point names - debian/patches/CVE-2026-35189.patch: Excessive memory allocation from relative CRL distribution point names - CVE-2026-35189

0 tuxcare-debian11-els libssl-dev_1.1.1w-0+deb11u8+tuxcare.els3_amd64.deb b964ec2fd7ed5bdc8485475117aa668f65801e56 libssl-doc_1.1.1w-0+deb11u8+tuxcare.els3_all.deb 449107f2cd00d5da8611f1c3b8d42140b8bdbcbf libssl1.1_1.1.1w-0+deb11u8+tuxcare.els3_amd64.deb aec499ce2a8465c791d9dd8e5e9c1d9a4f7b6cbc openssl_1.1.1w-0+deb11u8+tuxcare.els3_amd64.deb f31115787b49a5a03f9ad22843936d0033014175 libssl-dev_1.1.1w-0+deb11u8+tuxcare.els3_arm64.deb a6d4121d9f5ea63c8c000a36e5234248e48cf069 libssl1.1_1.1.1w-0+deb11u8+tuxcare.els3_arm64.deb df9265693e9beec06e1ca584fbe9d1ccaf044035 openssl_1.1.1w-0+deb11u8+tuxcare.els3_arm64.deb 8207eb02aca458f7bd5174ad99e08c16256d8616 libssl-dev_1.1.1w-0+deb11u8+tuxcare.els3_armel.deb 2776172c10b8d9b9218b8c6a733be5aef954a5f3 libssl1.1_1.1.1w-0+deb11u8+tuxcare.els3_armel.deb 7623e9f686a2f47998bacef8f4512a9111456118 openssl_1.1.1w-0+deb11u8+tuxcare.els3_armel.deb 4e404caf65c938110ce93dd7fa0c23b9b75e8e52 CLSA-2026:1791492996 TuxCare License Agreement 0 * SECURITY UPDATE: HTTP header injection via obsolete line folding - debian/patches/CVE-2026-63385.patch: reject any header value that contains a CR or LF character in evhttp_header_is_valid_value() in http.c, test/regress_http.c; backported partially: a %00 escape decoded to a NUL byte by evhttp_decode_uri_internal() is still accepted, as in upstream - CVE-2026-63385 * SECURITY UPDATE: HTTP request smuggling via Transfer-Encoding handling and bare-LF chunk framing - debian/patches/CVE-2026-63382.patch: require CRLF to terminate chunk size lines, reject requests with both Transfer-Encoding and Content-Length or with duplicate Content-Length headers, and parse every Transfer-Encoding header so that only a list ending in "chunked" selects chunked framing in http.c, http-internal.h, test/regress_http.c - CVE-2026-63382 Low Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: HTTP header injection via obsolete line folding - debian/patches/CVE-2026-63385.patch: reject any header value that contains a CR or LF character in evhttp_header_is_valid_value() in http.c, test/regress_http.c; backported partially: a %00 escape decoded to a NUL byte by evhttp_decode_uri_internal() is still accepted, as in upstream - CVE-2026-63385 * SECURITY UPDATE: HTTP request smuggling via Transfer-Encoding handling and bare-LF chunk framing - debian/patches/CVE-2026-63382.patch: require CRLF to terminate chunk size lines, reject requests with both Transfer-Encoding and Content-Length or with duplicate Content-Length headers, and parse every Transfer-Encoding header so that only a list ending in "chunked" selects chunked framing in http.c, http-internal.h, test/regress_http.c - CVE-2026-63382

0 tuxcare-debian11-els libevent-2.1-7_2.1.12-stable-1+tuxcare.els2_amd64.deb c8b8ecae96144e27c699ad987e0e3596d70785d6 libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els2_amd64.deb f6bf67e8818004ca8257b14fe5a37aa998c5972e libevent-dev_2.1.12-stable-1+tuxcare.els2_amd64.deb 83adf0850bf1e2bb310b4f959346c81c2affb225 libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els2_amd64.deb 00791dbfed5dc2b76cf12027a1375d2162ad4771 libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els2_amd64.deb cd85e7a28c71eeb5bed94d262a7a30e705b7a881 libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els2_amd64.deb 7811de43f52e410c1b0a3d0bd54c1ac751d1f452 libevent-2.1-7_2.1.12-stable-1+tuxcare.els2_arm64.deb b77ad42db024ee3b5c9abdce29f6f8c1b35ff19e libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els2_arm64.deb f6c98470bc853399717f58f52ac69d8177267677 libevent-dev_2.1.12-stable-1+tuxcare.els2_arm64.deb f061e58a06ff5f024c3d74b19112a0cffb7f785e libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els2_arm64.deb bb7f90e16f6a80588943f1a1cb4bfd51a72347af libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els2_arm64.deb eec98371c3a2df1536522b03f2a2e5b6397ad961 libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els2_arm64.deb c490c06b25c817a7117593f8469cfbe3fc44a917 libevent-2.1-7_2.1.12-stable-1+tuxcare.els2_armel.deb 80ff0da10468c9acf975b3217a57b5cd387a1647 libevent-core-2.1-7_2.1.12-stable-1+tuxcare.els2_armel.deb 1d5c1ec417e6ef91763303adbd6879f585074b01 libevent-dev_2.1.12-stable-1+tuxcare.els2_armel.deb 1a2838fd9db4b06c535afa4dc343c79dbbdbb39a libevent-extra-2.1-7_2.1.12-stable-1+tuxcare.els2_armel.deb 1bc4547ae5c5aecf238bc2f5ed34e9ab1d5e5f42 libevent-openssl-2.1-7_2.1.12-stable-1+tuxcare.els2_armel.deb 6024a60cdfaea78f28ec2a47a2009edfc80a0171 libevent-pthreads-2.1-7_2.1.12-stable-1+tuxcare.els2_armel.deb f2f93bf2fe4312071809140747f8c06e17b4e281 CLSA-2026:1791497664 TuxCare License Agreement 0 * SECURITY UPDATE: Denial of service via DNSSEC algorithmic complexity attacks (ReTrap) - debian/patches/CVE-2026-85501.patch: limit DNSKEY/RRSIG and DS/DNSKEY tag matches, DNSSEC validation and hash attempts and NSEC/NSEC3 validations, shorten oversized DS RRsets, stop validator restarts once a limit is hit, add the val-validation-attempts and val-hash-attempts options and change the val-clean-additional default to no - CVE-2026-85501 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Denial of service via DNSSEC algorithmic complexity attacks (ReTrap) - debian/patches/CVE-2026-85501.patch: limit DNSKEY/RRSIG and DS/DNSKEY tag matches, DNSSEC validation and hash attempts and NSEC/NSEC3 validations, shorten oversized DS RRsets, stop validator restarts once a limit is hit, add the val-validation-attempts and val-hash-attempts options and change the val-clean-additional default to no - CVE-2026-85501

0 tuxcare-debian11-els libunbound-dev_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 4402279f44cd72556232a298248cd586f334a390 libunbound8_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 698ec60602535dc3b63830a6198c72238b752ded python3-unbound_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 24a81626a915a1fdca9b22b7b52626d6641b6113 unbound_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 0a5328d5caa54a9db47e58d7c9239d1832e15239 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 7161b583ab07f7eb2c7dd18555bb24e318c0ac05 unbound-host_1.13.1-1+deb11u7+tuxcare.els4_amd64.deb 62843069b51b95983073a4452ea88e7a622a1f13 libunbound-dev_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb f8578acc838c645b51b26473a5bc46f2b5bfe464 libunbound8_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb b7c146dc75e4b6d371863c520a6932aae6267910 python3-unbound_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb ffa9f95453becbc07ae3e18af0c10636bc01205e unbound_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb 35a55c3b6cca8be96bd9ff6d9abc6ea72ec922a9 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb bc45992f59607c4bf55aee8a46e7fad4efac427b unbound-host_1.13.1-1+deb11u7+tuxcare.els4_arm64.deb 8b7a0a8737d01ea2ae37d444f73e85ee5adf240a libunbound-dev_1.13.1-1+deb11u7+tuxcare.els4_armel.deb 8972ff5122381cf403b90904659a8b7822c4d7ab libunbound8_1.13.1-1+deb11u7+tuxcare.els4_armel.deb bc8a29634d5cb40d43a0c1f88697539f88fca7c1 python3-unbound_1.13.1-1+deb11u7+tuxcare.els4_armel.deb 36d8e08a2ca60df94d24a896c481c80600141e51 unbound_1.13.1-1+deb11u7+tuxcare.els4_armel.deb b4801448fe10c09b93ce6fc23293adfcb35168e5 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els4_armel.deb 78585b959aa0080c8995d758a90914a8109ba74c unbound-host_1.13.1-1+deb11u7+tuxcare.els4_armel.deb 363104cfb4741384176dcfd09b17d79750727805 CLSA-2026:1791500436 TuxCare License Agreement 0 * SECURITY UPDATE: wrong connection reuse across Negotiate service names - debian/patches/CVE-2026-8458.patch: keep the service name and the proxy service name on the connection and compare them when looking for a connection to reuse in lib/urldata.h, lib/url.c and lib/http_negotiate.c. - CVE-2026-8458 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: wrong connection reuse across Negotiate service names - debian/patches/CVE-2026-8458.patch: keep the service name and the proxy service name on the connection and compare them when looking for a connection to reuse in lib/urldata.h, lib/url.c and lib/http_negotiate.c. - CVE-2026-8458

0 tuxcare-debian11-els curl_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb 528ac6fb469b8448050f1f22e240d3d04a67353d libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb 66ae0d2cc96b7f25def8a303c5ce33ca8537836c libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb ebe2d3dbb7ae3003b93e82c45d28b52ed450a32f libcurl4_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb 66ffeb804f13ca9924f2edd17329c58572dd68a4 libcurl4-doc_7.74.0-1.3+deb11u16+tuxcare.els3_all.deb 758f1403d672af997776886e19b16bcad0c7c3e2 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb e6c51b92e47c97ba9c3c522f3ed7ccdc794eaf70 libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb a4c45b765533e2850e818ff9a50fa029efe67dfa libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els3_amd64.deb 0bdfbe713771d6bc07361836ead0111f7623dc4f curl_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb a2eda5d48671f7978f4e8ae6a4d50ec1654ddfb3 libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb 0f6738849425a0d06a7ad9f6fc9f53f4b501813d libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb 14473c896594c8beae94fcdb116e77766e28fd14 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb 8d2b71247b9f0200fe49a1f7c188a98c2a4a3724 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb c72926858b679e10c25cfd003df0c4bada812e14 libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb a518bb96d2423ce4fd0b72c930b8d3f3f0e81d34 libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els3_arm64.deb f7113aa74cd54a051df5afedd9fcf740ec24e217 curl_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb f13f8e97e659dc479f4d4ad66ca04cf475b3866f libcurl3-gnutls_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb 69dd617fc6f21837b8a27df164ed44e8a03d66d8 libcurl3-nss_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb bfa7cd5e28f7ccb86e1c43fb698d8bd55abcd192 libcurl4_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb d6debb0a87d460d72f038383e6a888122dc79c45 libcurl4-gnutls-dev_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb ecacd1faaad1b98f4cd3f8134bb915b3d6311f4a libcurl4-nss-dev_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb f6e6163fe434ec3e80dd21a1112630ef50a7e4ff libcurl4-openssl-dev_7.74.0-1.3+deb11u16+tuxcare.els3_armel.deb 882151f9530ee0577ee30bb12d5d7f6ec696e529 CLSA-2026:1790709150 TuxCare License Agreement 0 * SECURITY UPDATE: Denial of service via quadratic complexity in storeAtts(), which scanned elementType->defaultAtts linearly to determine the CDATA status of every non-normalized attribute (libexpat through 2.8.3) - debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element defaultAttsNames hash table and use a hash lookup instead of the linear scan in expat/lib/xmlparse.c; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries, and carries upstream's regression test into expat/tests/runtests.c - CVE-2026-66046 * SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser (libexpat through 2.8.4) - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings in expat/lib/xmltok.c and dropping the permissive fallback from expat/lib/xmltok_impl.c; also carries upstream's regression test into expat/tests/runtests.c - CVE-2026-93990 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Denial of service via quadratic complexity in storeAtts(), which scanned elementType->defaultAtts linearly to determine the CDATA status of every non-normalized attribute (libexpat through 2.8.3) - debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element defaultAttsNames hash table and use a hash lookup instead of the linear scan in expat/lib/xmlparse.c; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries, and carries upstream's regression test into expat/tests/runtests.c - CVE-2026-66046 * SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser (libexpat through 2.8.4) - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings in expat/lib/xmltok.c and dropping the permissive fallback from expat/lib/xmltok_impl.c; also carries upstream's regression test into expat/tests/runtests.c - CVE-2026-93990

0 tuxcare-debian11-els expat_2.2.10-2+deb11u7+tuxcare.els4_amd64.deb bead265de4fb349e82691d6107bec2e207c9c013 libexpat1_2.2.10-2+deb11u7+tuxcare.els4_amd64.deb fe731025b52c941664f46069214ecb2e144f46b9 libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els4_amd64.deb cafb32f13963871f7e0ec299b07f52d323bca648 expat_2.2.10-2+deb11u7+tuxcare.els4_arm64.deb cc17d46be23240f725f14e190257dcf31cc0dab6 libexpat1_2.2.10-2+deb11u7+tuxcare.els4_arm64.deb d3c5f2cd8837815c31e6c66d92e3b18ffde11abb libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els4_arm64.deb c6d38b5b6c74e07115f5a06b2eed5b4c9e8c293e expat_2.2.10-2+deb11u7+tuxcare.els4_armel.deb 830f90419cab1fd0fc24889067497097afb0f209 libexpat1_2.2.10-2+deb11u7+tuxcare.els4_armel.deb 6976998c3477bef823da851ee95cf7b040899a1f libexpat1-dev_2.2.10-2+deb11u7+tuxcare.els4_armel.deb cb6f1eb9db177f9017087daf9e5d1bda69915783 CLSA-2026:1791540804 TuxCare License Agreement 0 * SECURITY UPDATE: DataSourceRealm and JDBCRealm getPrincipal() returned a principal for a user that does not exist or when the database could not be reached, and a failed role lookup did not fail authentication - debian/patches/CVE-2026-68569.patch: validate that the user exists in getPrincipal(), fail authentication and principal lookup when the role query fails, and return an empty role list when no role store is defined - CVE-2026-68569 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: DataSourceRealm and JDBCRealm getPrincipal() returned a principal for a user that does not exist or when the database could not be reached, and a failed role lookup did not fail authentication - debian/patches/CVE-2026-68569.patch: validate that the user exists in getPrincipal(), fail authentication and principal lookup when the role query fails, and return an empty role list when no role store is defined - CVE-2026-68569

0 tuxcare-debian11-els libtomcat9-embed-java_9.0.118-0+deb11u1+tuxcare.els2_all.deb 8f3570b42ce72b23dc4d6b82565a96e7ebbca522 libtomcat9-java_9.0.118-0+deb11u1+tuxcare.els2_all.deb 3a1547b449034f50515e2d1b7bed41a028f7adc2 tomcat9_9.0.118-0+deb11u1+tuxcare.els2_all.deb f08b83b39e43f4ee44e8c9706980906dbf50c693 tomcat9-admin_9.0.118-0+deb11u1+tuxcare.els2_all.deb e3b3e6de309bca71a01ed097c4c5f6ce21c4d11a tomcat9-common_9.0.118-0+deb11u1+tuxcare.els2_all.deb b1ae642b84ee171ce0f09357209d8ec6771719c4 tomcat9-docs_9.0.118-0+deb11u1+tuxcare.els2_all.deb d21bbb39f5d2b377e8663c7ccc163d49fd6b3b6f tomcat9-examples_9.0.118-0+deb11u1+tuxcare.els2_all.deb 00b95c8dda72a826cb7f77830131a0b68b6e5be3 tomcat9-user_9.0.118-0+deb11u1+tuxcare.els2_all.deb 197e7d00d7f534bb27e439b788c1059d0c09a7ef CLSA-2026:1791568039 TuxCare License Agreement 0 * SECURITY UPDATE: Incorrect free in pcre2_jit_match() when a match data block that held a copied subject from an earlier pcre2_match() call with PCRE2_COPY_MATCHED_SUBJECT was reused, because the JIT fast path overwrote the subject without releasing the copy - debian/patches/CVE-2026-89161.patch: free a previously copied subject in src/pcre2_jit_match.c, with pcre2test handling and test coverage in testdata/testinput17 and testdata/testoutput17 - CVE-2026-89161 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Incorrect free in pcre2_jit_match() when a match data block that held a copied subject from an earlier pcre2_match() call with PCRE2_COPY_MATCHED_SUBJECT was reused, because the JIT fast path overwrote the subject without releasing the copy - debian/patches/CVE-2026-89161.patch: free a previously copied subject in src/pcre2_jit_match.c, with pcre2test handling and test coverage in testdata/testinput17 and testdata/testoutput17 - CVE-2026-89161

0 tuxcare-debian11-els libpcre2-16-0_10.36-2+deb11u1+tuxcare.els7_amd64.deb 8450934b7ac129fbea008bf259a8ade565e2266e libpcre2-32-0_10.36-2+deb11u1+tuxcare.els7_amd64.deb 627930198d5f01c24422f5aaff766cf9e9879ea7 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els7_amd64.deb 2aa5fc9307cc7385f7f183b043f4e907d31264ad libpcre2-dev_10.36-2+deb11u1+tuxcare.els7_amd64.deb 84c90086ae3917323e742eff42a8555267e70d3a libpcre2-posix2_10.36-2+deb11u1+tuxcare.els7_amd64.deb e04e30cd5179cabcf47598863d8273761c4e6dba pcre2-utils_10.36-2+deb11u1+tuxcare.els7_amd64.deb d8b53992d143867abe088eef9074f6ff93905c66 libpcre2-16-0_10.36-2+deb11u1+tuxcare.els7_arm64.deb 0f7b0b2411ce20ecd406382e4f9e9e70ccdc779a libpcre2-32-0_10.36-2+deb11u1+tuxcare.els7_arm64.deb 5b6255e7afe5f8d8fe01eb8427f759628505c1f9 libpcre2-8-0_10.36-2+deb11u1+tuxcare.els7_arm64.deb 47f208f02999bd7603884c6cbde02749bfb25442 libpcre2-dev_10.36-2+deb11u1+tuxcare.els7_arm64.deb 836ca7d4cee53079181282d3f697f376a781dc3a libpcre2-posix2_10.36-2+deb11u1+tuxcare.els7_arm64.deb f32ec2ba5c717ea5c5b473fb11a81ecd0be807f9 pcre2-utils_10.36-2+deb11u1+tuxcare.els7_arm64.deb 6cd3f68075f6d289f7d1ea92ddbc85f9dcd90f9d libpcre2-16-0_10.36-2+deb11u1+tuxcare.els7_armel.deb d84bfc86cc41b456345b6f49d1dbe8049cf5042b libpcre2-32-0_10.36-2+deb11u1+tuxcare.els7_armel.deb 83f32362275a143b2dfb660d931989faa9ab0b1f libpcre2-8-0_10.36-2+deb11u1+tuxcare.els7_armel.deb 0b7ceb4ad69573d9f6adca757c0d064881ffda12 libpcre2-dev_10.36-2+deb11u1+tuxcare.els7_armel.deb 9a7a101102dbe904490f05ae9c17d1edb93bd9d7 libpcre2-posix2_10.36-2+deb11u1+tuxcare.els7_armel.deb f21cac02da5317e6994aaab443c20ec504b67823 pcre2-utils_10.36-2+deb11u1+tuxcare.els7_armel.deb 5c7ea465ba5bf2a632664d688de57ec26b4f8872 CLSA-2026:1791569890 TuxCare License Agreement 0 * SECURITY UPDATE: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization - debian/patches/CVE-2026-96512.patch: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization - CVE-2026-96512 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization - debian/patches/CVE-2026-96512.patch: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization - CVE-2026-96512

0 tuxcare-debian11-els sudo_1.9.5p2-3+deb11u4+tuxcare.els2_amd64.deb 3b7fab6f953ad870e30b454a5ee1a2f411229242 sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els2_amd64.deb 3f9215374db12880c3e11f6b73a2925a297a13a8 sudo_1.9.5p2-3+deb11u4+tuxcare.els2_arm64.deb bc4eb642ea0c6300af755d9a7c3f49c6df4c121f sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els2_arm64.deb 0b3d0fbc5f4f286ae6d9bfe725b45c7bff3458c0 sudo_1.9.5p2-3+deb11u4+tuxcare.els2_armel.deb a3863eae02d0cac8c70ae1bc8557b0f218743b87 sudo-ldap_1.9.5p2-3+deb11u4+tuxcare.els2_armel.deb 05fc7f9e11195c5e409f425a85d2d69b74797f83 CLSA-2026:1791654193 TuxCare License Agreement 0 * SECURITY UPDATE: Denial of service via unbounded consecutive reads on a TCP/DoT connection - debian/patches/CVE-2026-80225.patch: limit the number of pipelined TCP/DoT queries drained per event loop turn and defer the rest with a zero-delay timer - CVE-2026-80225 * SECURITY UPDATE: Heap buffer overflow during DNSSEC RRset canonicalisation - debian/patches/CVE-2026-81634.patch: check the RRSIG rdata, the first owner name and each RR's rdata against the remaining buffer space in rrset_canonical() - CVE-2026-81634 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Denial of service via unbounded consecutive reads on a TCP/DoT connection - debian/patches/CVE-2026-80225.patch: limit the number of pipelined TCP/DoT queries drained per event loop turn and defer the rest with a zero-delay timer - CVE-2026-80225 * SECURITY UPDATE: Heap buffer overflow during DNSSEC RRset canonicalisation - debian/patches/CVE-2026-81634.patch: check the RRSIG rdata, the first owner name and each RR's rdata against the remaining buffer space in rrset_canonical() - CVE-2026-81634

0 tuxcare-debian11-els libunbound-dev_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb 0b14da476414f449078c4974e4fd1d7582eb7809 libunbound8_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb 1c1e68933c550596fc4c2c2a2f944e55d62988a8 python3-unbound_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb cb239d8aa19072ede3de6ba1289fc45388484ef0 unbound_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb 870f92eb8509c909672a314b70d3c3ee296f3bc3 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb 4bd4d1007bebdca0d847a5ea55c031709bff6be8 unbound-host_1.13.1-1+deb11u7+tuxcare.els5_amd64.deb 09b6198ba17e9bfc26cd116cbedb9684d3685482 libunbound-dev_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb 61c84db8de67600f6a29842b293a72dc38b6fe4a libunbound8_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb 7022fc5b81463c6805b7707d1acbd04f0e3cb9da python3-unbound_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb fefe079c7d8a09388d5cafd7e83e68d212941213 unbound_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb 36fe2c92857fc08de3bbbf42b7c5201524798d29 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb a46afa93700df593f901383b634eca6daa232242 unbound-host_1.13.1-1+deb11u7+tuxcare.els5_arm64.deb 0bdedbe574ce8b7538b42e89809fcd81895fedd2 libunbound-dev_1.13.1-1+deb11u7+tuxcare.els5_armel.deb f086ee6ab174bc5cb5fea1a9b1900ce006112540 libunbound8_1.13.1-1+deb11u7+tuxcare.els5_armel.deb cbbcb80503e2e195da233b53f0f59d37d293394f python3-unbound_1.13.1-1+deb11u7+tuxcare.els5_armel.deb ec5e7af8db85eff301c289c32e8684fd0134e7de unbound_1.13.1-1+deb11u7+tuxcare.els5_armel.deb 2af99cf5b9aacbb16508638ae9bbf053a6100715 unbound-anchor_1.13.1-1+deb11u7+tuxcare.els5_armel.deb 21ce66121742d583309f772163fefba3e6c48aa2 unbound-host_1.13.1-1+deb11u7+tuxcare.els5_armel.deb 721b7ffc1f2da2a3296fce822f8fb678370cfb10 CLSA-2026:1791654368 TuxCare License Agreement 0 * SECURITY UPDATE: unbounded decompression of compressed packets - debian/patches/CVE-2026-106585.patch: fail uncompress_buffer() in packet.c once the decompressed payload reaches PACKET_MAX_SIZE, so a highly compressed packet cannot inflate past the maximum packet length. - CVE-2026-106585 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: unbounded decompression of compressed packets - debian/patches/CVE-2026-106585.patch: fail uncompress_buffer() in packet.c once the decompressed payload reaches PACKET_MAX_SIZE, so a highly compressed packet cannot inflate past the maximum packet length. - CVE-2026-106585

0 tuxcare-debian11-els openssh-client_8.4p1-5+deb11u7+tuxcare.els3_amd64.deb 5464b49272004f0cc12cc341f3839dc8da980c27 openssh-server_8.4p1-5+deb11u7+tuxcare.els3_amd64.deb 24c1035de77ddfb66053d9a202a2b5438e70ff1e openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els3_amd64.deb 97d22131c419b5d9d67dbfaf02f68ddc855fb181 openssh-tests_8.4p1-5+deb11u7+tuxcare.els3_amd64.deb 8b5edf28c0460f17bcf1d559be873c51b2081381 ssh_8.4p1-5+deb11u7+tuxcare.els3_all.deb 5a9fef4c7ea34afcf6bca4a865571594f9de6cf0 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els3_amd64.deb 9b4bf79a1aaebede2e10311e8c2888856e96e109 openssh-client_8.4p1-5+deb11u7+tuxcare.els3_arm64.deb 05875ae7c1ad746e611b14afe815d5e6e27e29ae openssh-server_8.4p1-5+deb11u7+tuxcare.els3_arm64.deb d4d47d6bba6b56fc0f2295dbcb38720200efd9cb openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els3_arm64.deb b27634a36f02194e673f5d99a519e0dc6831ec11 openssh-tests_8.4p1-5+deb11u7+tuxcare.els3_arm64.deb 472b46ab98a47a34441ee679bf69bb60c978e9db ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els3_arm64.deb 5a830414e7aed284c739372a79399b0882442c5e openssh-client_8.4p1-5+deb11u7+tuxcare.els3_armel.deb 9e3c51c4ace14313101a845af3d86cb0766a1d4a openssh-server_8.4p1-5+deb11u7+tuxcare.els3_armel.deb db524cb8dcda46d39005539c9af53a3a8ce24433 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els3_armel.deb a153b6687e56c067ee999859f9ffbe9767faa716 openssh-tests_8.4p1-5+deb11u7+tuxcare.els3_armel.deb d552dc80fbbd6e155340869ad7d34f65b465e791 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els3_armel.deb ff02e69d7ccf721baea22db3fc50733841b9084a CLSA-2026:1791816233 TuxCare License Agreement 0 * SECURITY UPDATE: out-of-bounds memory access in the BPF interpreter - debian/patches/CVE-2026-0799.patch: reject scratch memory register indexes >= BPF_MEMWORDS in bpf_filter.c - CVE-2026-0799 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: out-of-bounds memory access in the BPF interpreter - debian/patches/CVE-2026-0799.patch: reject scratch memory register indexes >= BPF_MEMWORDS in bpf_filter.c - CVE-2026-0799

0 tuxcare-debian11-els libpcap-dev_1.10.0-2+tuxcare.els1_amd64.deb 6812c33e35887256581be2f0ec655de0ca8284d9 libpcap0.8_1.10.0-2+tuxcare.els1_amd64.deb 15dba6b185201f276ce4a155ef994fce4488fe1f libpcap0.8-dev_1.10.0-2+tuxcare.els1_amd64.deb ec5f7cc72f24769903f12679b89188e5cfe7c493 libpcap-dev_1.10.0-2+tuxcare.els1_arm64.deb 36dd7d9a88b96acd103aeefb9e2854efe0733a93 libpcap0.8_1.10.0-2+tuxcare.els1_arm64.deb 0bc2fe5d85feaf7c6dca5d85b510a96aed20d2ee libpcap0.8-dev_1.10.0-2+tuxcare.els1_arm64.deb 8709b05e73e769b5ef0a48573f9fc69987f77b50 libpcap-dev_1.10.0-2+tuxcare.els1_armel.deb b6f44d9a772748a3e8d6cc70f0eddd0d53eb6cdd libpcap0.8_1.10.0-2+tuxcare.els1_armel.deb 08ca6e1155a8ae4bbc5b0fdbad218a8ef02dc36b libpcap0.8-dev_1.10.0-2+tuxcare.els1_armel.deb fb002c7eec868136af7000a3d047b6f7d087bab8 CLSA-2026:1791857118 TuxCare License Agreement 0 * SECURITY UPDATE: code injection via crafted filename in netrw mf command - debian/patches/CVE-2026-43961.patch: code injection via crafted filename in netrw mf command - CVE-2026-43961 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: code injection via crafted filename in netrw mf command - debian/patches/CVE-2026-43961.patch: code injection via crafted filename in netrw mf command - CVE-2026-43961

0 tuxcare-debian11-els vim_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb d41cd240e78e9a1b2d623533a37d4e8aafa8a6f1 vim-athena_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb 0c0f0858306563c6cac4675940b05e5254f66ec5 vim-common_8.2.2434-3+deb11u3+tuxcare.els17_all.deb bdd2b6ecc6f4064d1766e822b24e65be10674330 vim-doc_8.2.2434-3+deb11u3+tuxcare.els17_all.deb 9e252bad160768be96d69c7be686181f4541bf24 vim-gtk_8.2.2434-3+deb11u3+tuxcare.els17_all.deb ee2484c3c42001532620ce997980df845dd64571 vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb 03bd0569cc46cbe698bed96511184095d7a646e8 vim-gui-common_8.2.2434-3+deb11u3+tuxcare.els17_all.deb f9971b190cac3ee5c8eda0de4742d2d7bcafa308 vim-nox_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb 07b0dc6ff4ef7b572894518af02f05fb95e20a3f vim-runtime_8.2.2434-3+deb11u3+tuxcare.els17_all.deb ec95260e5662c64c428bb1fca2de224916eea437 vim-tiny_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb 663843197db47b9accf4a01de6c2f24f3723a488 xxd_8.2.2434-3+deb11u3+tuxcare.els17_amd64.deb 7d1a57fbe421a56c39b639fdb5c431c931850e0e vim_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb 4fde91b8bceb44ce39fe5d6e42e839514df8120c vim-athena_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb 1cd1bfd58dace2bb26cb7e9b11ddb54dabe7efae vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb de51cc20c30e6b64bb5e386617c56d983a09eb20 vim-nox_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb 901b52fae563225d86d6a397e04b4a27337ed28b vim-tiny_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb bc9d9ea4e012239d4156cd797233e8623fdadbc5 xxd_8.2.2434-3+deb11u3+tuxcare.els17_arm64.deb 96ac751fad0d4dcce372463bb36d63ad3eaff503 vim_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb 41662a0382a4c3e9b28188695678bb5a60e2c105 vim-athena_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb 833f8956694cdec21223cdc00cc0e9b583af076f vim-gtk3_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb b3af9086fbb91650efa1bf2993124684da92da54 vim-nox_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb c44041b39909b935f78251b199a6fc24a7938b1e vim-tiny_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb 4a524c882a4c2797115e000857bfad077f4b164d xxd_8.2.2434-3+deb11u3+tuxcare.els17_armel.deb bfc88a64f3993c987aeea0fdb38176d8ec99515b CLSA-2026:1791858489 TuxCare License Agreement 0 * SECURITY UPDATE: replay of DIGEST-MD5 responses via unverified nonce - debian/patches/CVE-2026-86219.patch: reject responses whose nonce does not match the one issued in server_step - CVE-2026-86219 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: replay of DIGEST-MD5 responses via unverified nonce - debian/patches/CVE-2026-86219.patch: reject responses whose nonce does not match the one issued in server_step - CVE-2026-86219

0 tuxcare-debian11-els libauthen-sasl-perl_2.1600-1.1+tuxcare.els1_all.deb b28d940ba777d19aed4e3a1bb7b8deca660ebc9e CLSA-2026:1791892215 TuxCare License Agreement 0 * SECURITY UPDATE: TOCTOU symlink traversal in getfacl, setfacl and chacl - debian/patches/CVE-2026-54370.patch: walk trees through directory file descriptors and act on the final pathname component with symlink-safe calls in tools/getfacl.c, tools/setfacl.c, tools/do_set.c and tools/chacl.c - the *at() ACL operations the hardened tools need are private helpers in tools/acl_at.c, so libacl's public ABI and installed headers are unchanged - setfacl --restore is symlink-safe only when invoked with -P: without it the backup's pathnames are still resolved by name, so stat, chown, chmod and the ACL write still follow symlinks; upstream's warning about that is built out with --disable-unsafe-restore-warnings, so --restore output is unchanged for scripts that parse stderr - getfacl -P and setfacl -P now fail with ELOOP on a symlink argument instead of silently ignoring it - in the recursive default mode a toplevel symlink-to-directory argument is now descended into, where 2.2.53 applied to the toplevel entry only; 'setfacl -R <symlink-to-dir>' therefore writes to the whole subtree (upstream 2.4.0 walk_tree semantics) - chacl on a symlink given on the command line now fails with "Operation not supported" instead of acting on the symlink's target - getfacl no longer strips a leading './' from pathnames, so 'getfacl -R ./dir' prints '# file: ./dir' for the toplevel entry - the symlink-safe paths need /proc mounted: without it getfacl and setfacl warn and then fail with EACCES ("Permission denied"), instead of falling back to the ACL derived from the file mode, which would drop every named entry and still exit successfully - debian/rules: configure with --disable-unsafe-restore-warnings, and skip test/root/permissions.test and test/root/setfacl.test on build hosts whose build tree is not reachable by unprivileged users, where they fail regardless of this patch - CVE-2026-54370 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: TOCTOU symlink traversal in getfacl, setfacl and chacl - debian/patches/CVE-2026-54370.patch: walk trees through directory file descriptors and act on the final pathname component with symlink-safe calls in tools/getfacl.c, tools/setfacl.c, tools/do_set.c and tools/chacl.c - the *at() ACL operations the hardened tools need are private helpers in tools/acl_at.c, so libacl's public ABI and installed headers are unchanged - setfacl --restore is symlink-safe only when invoked with -P: without it the backup's pathnames are still resolved by name, so stat, chown, chmod and the ACL write still follow symlinks; upstream's warning about that is built out with --disable-unsafe-restore-warnings, so --restore output is unchanged for scripts that parse stderr - getfacl -P and setfacl -P now fail with ELOOP on a symlink argument instead of silently ignoring it - in the recursive default mode a toplevel symlink-to-directory argument is now descended into, where 2.2.53 applied to the toplevel entry only; 'setfacl -R <symlink-to-dir>' therefore writes to the whole subtree (upstream 2.4.0 walk_tree semantics) - chacl on a symlink given on the command line now fails with "Operation not supported" instead of acting on the symlink's target - getfacl no longer strips a leading './' from pathnames, so 'getfacl -R ./dir' prints '# file: ./dir' for the toplevel entry - the symlink-safe paths need /proc mounted: without it getfacl and setfacl warn and then fail with EACCES ("Permission denied"), instead of falling back to the ACL derived from the file mode, which would drop every named entry and still exit successfully - debian/rules: configure with --disable-unsafe-restore-warnings, and skip test/root/permissions.test and test/root/setfacl.test on build hosts whose build tree is not reachable by unprivileged users, where they fail regardless of this patch - CVE-2026-54370

0 tuxcare-debian11-els acl_2.2.53-10+tuxcare.els1_amd64.deb 154cbb7e9e96539b319a3cfb316fb04d49eb2976 libacl1_2.2.53-10+tuxcare.els1_amd64.deb 844cbe938ed2c8216d99b1b30832b1644f84879d libacl1-dev_2.2.53-10+tuxcare.els1_amd64.deb 6821c3a19a0cead2df703c63fceaaa128c11b35a acl_2.2.53-10+tuxcare.els1_arm64.deb 7b35aa9e5e455f263270605a93d92d9e6bdc3aa8 libacl1_2.2.53-10+tuxcare.els1_arm64.deb 4a0c1420fb5b6da7d7e1083bf292e2c001851b84 libacl1-dev_2.2.53-10+tuxcare.els1_arm64.deb ec24fd8412bd816f8a65b90cd6c480f4f63105ed acl_2.2.53-10+tuxcare.els1_armel.deb 0cb0de9678eae352a1c2a1fa28b1235183fb6f5a libacl1_2.2.53-10+tuxcare.els1_armel.deb f444eabca461171cff88df0ba1174c22497f780a libacl1-dev_2.2.53-10+tuxcare.els1_armel.deb 41f878910764e8283a632f02c502f7ff9e056e37 CLSA-2026:1791896236 TuxCare License Agreement 0 * Update to upstream stable Linux 5.10.271 (from 5.10.270). * Bump kernel ABI to 50: ship the ELS kernel as 5.10.0-50-*, distinct from the prior 5.10.0-49. * CVE-2022-48816 - SUNRPC: lock against ->sock changing during sysfs read {CVE-2022-48816} * CVE-2022-49142 - net: preserve skb_end_offset() in skb_unclone_keeptruesize() {CVE-2022-49142} * CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406} * CVE-2023-53707 - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 {CVE-2023-53707} * CVE-2024-41062 - Reapply "bluetooth/l2cap: sync sock recv cb and release" {CVE-2024-41062} * CVE-2024-47408 - net/smc: check smcd_v2_ext_offset when receiving proposal msg {CVE-2024-47408} * CVE-2024-49568 - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg {CVE-2024-49568} * CVE-2024-56545 - HID: hyperv: streamline driver probe to avoid devres issues {CVE-2024-56545} * CVE-2025-21759 - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2026-52988 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase {CVE-2026-52988} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} * CVE-2026-74460 - can: ems_usb: validate CPC message lengths {CVE-2026-74460} * CVE-2026-74496 - fou: Fix use-after-free in fou_create() {CVE-2026-74496} * CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} * CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface {CVE-2026-80833} * CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface {CVE-2026-80834} * CVE-2026-90304 - ARM: 9484/1: enable interrupts when unhandled user faults are triggered {CVE-2026-90304} * CVE-2026-93204 - batman-adv: dat: atomically update mac addresses {CVE-2026-93204} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287} * CVE-2026-93782 - vhost-scsi: flush backend after device ioctls {CVE-2026-93782} * CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783} * CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() {CVE-2026-93784} * CVE-2026-93785 - cifs: validate idmap key payload length {CVE-2026-93785} * CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser {CVE-2026-93789} * CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure {CVE-2026-93795} * CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check {CVE-2026-93797} * CVE-2026-93798 - btrfs: fix reloc root cleanup in merge_reloc_roots() {CVE-2026-93798} * CVE-2026-93800 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() {CVE-2026-93800} * CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807} * CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808} * CVE-2026-93815 - net: au1000: move free_irq out of the close-time spinlocked section {CVE-2026-93815} * CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion {CVE-2026-93816} * CVE-2026-93819 - PCI: mediatek: Protect root bus removal with rescan lock {CVE-2026-93819} * CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock {CVE-2026-93820} * CVE-2026-93821 - PCI: altera: Protect root bus removal with rescan lock {CVE-2026-93821} * CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} * CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} * CVE-2026-97407 - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt {CVE-2026-97407} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-97411 - net: ibm: emac: mal: fix potential system hang in mal_remove() {CVE-2026-97411} * CVE-2026-97416 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() {CVE-2026-97416} * CVE-2026-97417 - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} * CVE-2026-97418 - ALSA: es18xx: check control allocation before private data setup {CVE-2026-97418} * CVE-2026-97419 - hsr: broadcast netlink notifications in the device's net namespace {CVE-2026-97419} * CVE-2026-97420 - bpf: NUL-terminate replaced sysctl value {CVE-2026-97420} * CVE-2026-97430 - xhci: Prevent queuing new commands if xhci is inaccessible {CVE-2026-97430} * CVE-2026-97435 - net: dsa: sja1105: flower: reject cross-chip redirect {CVE-2026-97435} * CVE-2026-97440 - net: qrtr: fix node refcount leak on ctrl packet alloc failure {CVE-2026-97440} * CVE-2026-97441 - ata: ahci: fail probe if BAR too small for claimed ports {CVE-2026-97441} * CVE-2026-97443 - perf/ftrace: Fix WARNING in __unregister_ftrace_function {CVE-2026-97443} * CVE-2026-97444 - ACPICA: add boundary checks in two places {CVE-2026-97444} * CVE-2026-97445 - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} * CVE-2026-97446 - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() {CVE-2026-97446} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97449 - ACPICA: Add package limit checks in parser functions {CVE-2026-97449} * CVE-2026-97450 - ACPICA: validate handler object type in two places {CVE-2026-97450} * CVE-2026-97451 - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) {CVE-2026-97451} * CVE-2026-97452 - ACPICA: Prevent adding invalid references {CVE-2026-97452} * CVE-2026-97453 - ACPICA: validate byte_count in acpi_ps_get_next_package_length() {CVE-2026-97453} * CVE-2026-97454 - ACPICA: add boundary checks in acpi_ps_get_next_field() {CVE-2026-97454} * CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} * CVE-2026-97456 - ACPICA: Fix condition check in acpi_ps_parse_loop() {CVE-2026-97456} * CVE-2026-97472 - ipv6: addrconf: fix temp address generation after prefix deprecation {CVE-2026-97472} * CVE-2026-97475 - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration {CVE-2026-97475} * CVE-2026-97476 - rds: filter RDS_INFO_* getsockopt by caller's netns {CVE-2026-97476} * CVE-2026-97481 - serial: 8250: fix possible ISR soft lockup {CVE-2026-97481} * CVE-2026-97482 - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log {CVE-2026-97482} * CVE-2026-97483 - usb: core: hcd: fix possible deadlock in rh control transfers {CVE-2026-97483} * CVE-2026-97484 - usbip: vhci_hcd: fix NULL deref in status_show_vhci {CVE-2026-97484} * CVE-2026-97485 - omfs: handle set_blocksize failures {CVE-2026-97485} * CVE-2026-97486 - hpfs: handle set_blocksize failures {CVE-2026-97486} * CVE-2026-97487 - jfs: handle set_blocksize failures {CVE-2026-97487} * CVE-2026-97488 - qnx4: handle set_blocksize failures {CVE-2026-97488} * CVE-2026-97489 - bfs: handle set_blocksize failures {CVE-2026-97489} * CVE-2026-97490 - affs: handle set_blocksize failures {CVE-2026-97490} * CVE-2026-97491 - net/rds: Don't sleep inside rds_ib_conn_path_shutdown {CVE-2026-97491} * CVE-2026-97492 - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed {CVE-2026-97492} * CVE-2026-97502 - mmc: davinci: avoid NULL deref of host->data in IRQ handler {CVE-2026-97502} * CVE-2026-97507 - media: dm1105: fix missing error check for dma_alloc_coherent {CVE-2026-97507} * CVE-2026-97508 - thunderbolt: Set tb->root_switch to NULL when domain is stopped {CVE-2026-97508} * CVE-2026-97510 - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() {CVE-2026-97510} * CVE-2026-97523 - mptcp: close race between scheduler and state change {CVE-2026-97523} * CVE-2026-97524 - mptcp: avoid unneeded actions on subflow reset {CVE-2026-97524} * CVE-2026-97568 - mptcp: syncookies: remember the request backup flag {CVE-2026-97568} * CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() {CVE-2026-97572} * CVE-2026-97573 - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() {CVE-2026-97573} * CVE-2026-97592 - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm {CVE-2026-97592} * CVE-2026-97596 - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} * CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation {CVE-2026-97598} * CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink {CVE-2026-97601} * CVE-2026-97604 - fbdev: vfb: defer cleanup until the last reference {CVE-2026-97604} * CVE-2026-97611 - net: openvswitch: fix use-after-free of the flow table mask array {CVE-2026-97611} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-97899 - drm/i915: Fix memory leak in query_perf_config_list() {CVE-2026-97899} * CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication {CVE-2026-97904} * CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication {CVE-2026-97905} * CVE-2026-97909 - ASoC: sti: initialize IRQ lock before requesting IRQ {CVE-2026-97909} * CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations {CVE-2026-97910} * CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails {CVE-2026-97923} * CVE-2026-97926 - ufs: validate cylinder group metadata before caching it {CVE-2026-97926} * CVE-2026-97927 - ufs: create the root dentry after loading cylinder metadata {CVE-2026-97927} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97948 - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver {CVE-2026-97948} * CVE-2026-97951 - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands {CVE-2026-97951} * CVE-2026-97952 - sunvdc: unmap LDC cookies when the descriptor send fails {CVE-2026-97952} * CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954} * CVE-2026-97957 - net: hinic: fix mailbox segment buffer overflow {CVE-2026-97957} * CVE-2026-97958 - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). {CVE-2026-97958} * CVE-2026-97959 - net/sched: cls_route: free emptied bucket on filter move {CVE-2026-97959} * CVE-2026-97981 - net: ethernet: cortina: Count dropped frames as NAPI work {CVE-2026-97981} * CVE-2026-97982 - net: ethernet: cortina: Fix budget accounting {CVE-2026-97982} * CVE-2026-97993 - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx {CVE-2026-97993} * CVE-2026-97995 - virtio_console: do not free control-out buffers on remove {CVE-2026-97995} * CVE-2026-97998 - netfilter: nfnetlink_log: cope with concurrent instance destruction {CVE-2026-97998} * CVE-2026-98006 - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev {CVE-2026-98006} * CVE-2026-98009 - net/sched: ets: clamp quantum in parse and fallback paths {CVE-2026-98009} * CVE-2026-98010 - net/sched: drr: clamp quantum in change class {CVE-2026-98010} * CVE-2026-98011 - net/sched: hhf: clamp quantum in change and init paths {CVE-2026-98011} * CVE-2026-98012 - net/sched: sfq: clamp quantum in change path {CVE-2026-98012} * CVE-2026-98013 - net/sched: fq_pie: clamp quantum in change path {CVE-2026-98013} * CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} * CVE-2026-98022 - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations {CVE-2026-98022} * CVE-2026-98023 - vxlan: reject dynamic fdb entries that reference a nexthop id {CVE-2026-98023} * CVE-2026-98025 - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} * CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027} * CVE-2026-98030 - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size {CVE-2026-98030} * CVE-2026-98063 - bpf: Fix NULL-ptr-deref in btf_var_show() {CVE-2026-98063} * CVE-2026-98064 - bpf: Fix NULL-ptr-deref when showing a void BTF type {CVE-2026-98064} * CVE-2026-98066 - ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066} * CVE-2026-98068 - net/rds: don't let rds_conn_shutdown() consume a concurrent drop {CVE-2026-98068} * CVE-2026-98069 - net/rds: acquire the fastpath locks in rds_conn_shutdown() {CVE-2026-98069} * CVE-2026-98070 - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() {CVE-2026-98070} * CVE-2026-98071 - net/rds: clear cp_flags bits individually in rds_conn_path_reset() {CVE-2026-98071} * CVE-2026-98072 - net/rds: use wq_has_sleeper() in release_in_xmit() {CVE-2026-98072} * CVE-2026-98074 - bonding: do not clear curr_active_slave prematurely when releasing all slaves {CVE-2026-98074} * CVE-2026-98076 - tracing/probes: Fix use-after-free on field name/type of events with multiple probes {CVE-2026-98076} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-98078 - ipvs: fix reversed sequence option serialization {CVE-2026-98078} * CVE-2026-98080 - btrfs: do not force reloc root creation during qgroup_account_snapshot() {CVE-2026-98080} * CVE-2026-98091 - btrfs: detach failed sprout device from transaction update list {CVE-2026-98091} * CVE-2026-98094 - staging: fbtft: make dirty_lock IRQ-safe {CVE-2026-98094} * CVE-2026-98095 - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). {CVE-2026-98095} * CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} * CVE-2026-98108 - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} * CVE-2026-98123 - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration {CVE-2026-98123} * CVE-2026-98130 - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} * CVE-2026-98157 - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation {CVE-2026-98157} * CVE-2026-98158 - ppp_async: drop the errored frame instead of resetting its headroom {CVE-2026-98158} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-98186 - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186} * CVE-2026-98187 - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST {CVE-2026-98187} * CVE-2026-98188 - wifi: p54: validate curve data length in the calibration curve converters {CVE-2026-98188} * CVE-2026-98189 - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() {CVE-2026-98189} * CVE-2026-98190 - wifi: wilc1000: fix out-of-bounds read in P2P public action frames {CVE-2026-98190} * CVE-2026-98191 - wifi: wlcore: release runtime PM ref on regdomain config failure {CVE-2026-98191} * CVE-2026-98194 - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} * CVE-2026-98195 - wifi: iwlegacy: fix broadcast stations deallocation {CVE-2026-98195} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-98197 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} * CVE-2026-98201 - Input: zero ff_effect before compat copy in input_ff_effect_from_user {CVE-2026-98201} * CVE-2026-98202 - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound {CVE-2026-98202} * CVE-2026-98203 - Input: soc_button_array - check btns_desc->package.count {CVE-2026-98203} * CVE-2026-98204 - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() {CVE-2026-98204} * CVE-2026-98205 - Input: evdev - zero absinfo before partial copy in EVIOCSABS {CVE-2026-98205} * CVE-2026-98207 - mmc: spi: reset bytes_xfered before retrying CRC failures {CVE-2026-98207} * CVE-2026-98208 - mmc: sdio_uart: fix xmit_fifo leak when the port table is full {CVE-2026-98208} * CVE-2026-98209 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources {CVE-2026-98209} * CVE-2026-98210 - mmc: mxcmmc: cancel data work and watchdog on remove {CVE-2026-98210} * CVE-2026-98217 - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} * CVE-2026-98233 - net/packet: clear RX owner on VNET header error {CVE-2026-98233} * CVE-2026-98234 - net/sched: hhf: cap hh_flows_limit at change time {CVE-2026-98234} * CVE-2026-98241 - ipv6: xfrm: use full sockets in local error paths {CVE-2026-98241} * CVE-2026-98251 - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} * CVE-2026-98252 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() {CVE-2026-98252} * CVE-2026-98253 - RDMA/ucma: Serialize join and leave on copy_to_user failure {CVE-2026-98253} * CVE-2026-98255 - tcp: exclude old ACKs from tcp fast path {CVE-2026-98255} * CVE-2026-98257 - rds: ib: use rds_conn_drop() on protocol version mismatch {CVE-2026-98257} * CVE-2026-98262 - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} * CVE-2026-98272 - net: mvpp2: prevent buffer overflow in page_pool allocation {CVE-2026-98272} * CVE-2026-98275 - net: ethernet: cortina: Ack RX overrun interrupt correctly {CVE-2026-98275} * CVE-2026-98276 - net: lock the socket in sock_gettstamp() {CVE-2026-98276} * CVE-2026-98282 - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba {CVE-2026-98282} * CVE-2026-98298 - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() {CVE-2026-98298} * CVE-2026-98299 - tcp: do not let tcp_rmem be set below 4096 {CVE-2026-98299} * CVE-2026-98300 - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). {CVE-2026-98300} * CVE-2026-98302 - net: fddi: skfp: fix NULL deref when setting the MAC address while down {CVE-2026-98302} * CVE-2026-98306 - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation {CVE-2026-98306} * CVE-2026-98308 - ALSA: hda: trace PCM open only after assigning a stream {CVE-2026-98308} * CVE-2026-98311 - wifi: virt_wifi: don't transfer operstate before register {CVE-2026-98311} * CVE-2026-98314 - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} * CVE-2026-98319 - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr {CVE-2026-98319} * CVE-2026-98320 - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} * CVE-2026-98322 - netfilter: nft_nat: fully initialise new_addr in netmap setup {CVE-2026-98322} * CVE-2026-98323 - RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323} * CVE-2026-98339 - wifi: cfg80211: don't filter by BSS type when removing stale entries {CVE-2026-98339} * CVE-2026-98340 - wifi: cfg80211: only group hidden BSSes with beacon entries {CVE-2026-98340} * CVE-2026-98342 - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} * CVE-2026-98343 - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} * CVE-2026-98344 - dmaengine: Fix device kref underflow in dma_chan_put() {CVE-2026-98344} * CVE-2026-98345 - wifi: cfg80211: check IP header size in cfg80211_classify8021d() {CVE-2026-98345} * CVE-2026-98347 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush {CVE-2026-98347} * CVE-2026-98348 - wifi: libipw: reject too-short association responses {CVE-2026-98348} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98351 - wifi: virt_wifi: free skb when disconnected {CVE-2026-98351} * CVE-2026-98354 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} * CVE-2026-98357 - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} * CVE-2026-98358 - IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358} * CVE-2026-98362 - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate {CVE-2026-98362} * CVE-2026-98363 - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS {CVE-2026-98363} * CVE-2026-98367 - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} * CVE-2026-98370 - xfrm: fix compat ALLOCSPI request use-after-free {CVE-2026-98370} * CVE-2026-98379 - netfilter: ip6t_rpfilter: reject routes without inet6_dev {CVE-2026-98379} * CVE-2026-98380 - net/sched: reject IDR error pointers when deleting actions {CVE-2026-98380} * CVE-2026-98383 - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL {CVE-2026-98383} * Miscellaneous upstream changes - ima: return error early if file xattr cannot be changed - tee: optee: Allow MT_NORMAL_TAGGED shared memory - PCI: Stop setting cached power state to 'unknown' on unbind - hfsplus: fix issue of direct writes beyond end-of-file - wifi: mac80211: always allow transmitting null-data on TXQs - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: validate DT compatible before parsing it - media: rc: mceusb: Add support for 04eb:e033 - thunderbolt: Keep the domain reference while processing hotplug - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - clk: renesas: cpg-mssr: Add number of clock cells check - ASoC: ti: omap3pandora: update board check to use DT compatible - drm/amd/display: Fix CRC open failure during active rendering - hfsplus: rework hfsplus_readdir() logic - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - mailbox: Make mbox_send_message() return error code when tx fails - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - 9p: invalidate readdir buffer on seek - arm64/daifflags: Make local_daif_*() helpers __always_inline - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - bitfield: wire __bf_shf to __builtin_ctzll - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - befs: handle set_blocksize failures - minix: handle set_blocksize failures - isofs: handle set_blocksize failures - usb: host: add ARCH_AIROHA in XHCI MTK dependency - char/nvram: Remove redundant nvram_mutex - netlabel: fix IPv6 unlabeled address add error handling - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - drm/amd/pm/si: Fix updating clock limits from power states - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - hfs: rework hfsplus_readdir() logic - scripts: modpost: detect and report truncated buf_printf() output - ASoC: Intel: catpt: Complete coredump handling - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - iio: accel: mma8452: switch to non-devm request_threaded_irq() - net: ibm: emac: Reserve VLAN header in MJS limit - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - iommu/rockchip: disable fetch dte time limit - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - clk: keystone: don't cache clock rate - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/mlx5: Fix state and counter desync on loopback enable failure - net: cpsw_new: unregister devlink on port registration failure - xprtrdma: Add request-pool slack for delayed recycling - configfs_depend_prep(): pass configfs_dirent instead of dentry - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: transform aspm_conf for pci_disable_link_state - hwmon: (adt7462) Add of_match_table to support devicetree - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - sctp: Unwind address notifier registration on failure - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - sparc64: uprobes: add missing break - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net/sched: act_csum: don't mangle UDP tunnel GSO packets - sparc: Disable compat support with LLD - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - md/raid5: let stripe batch bm_seq comparison wrap-safe - rtc: aspeed: add AST2700 compatible - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - rtc: bq32000: add delay between RTC reads - fbdev: pm2fb: unwind WC setup on probe failure - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: libertas: reject short monitor TX frames - gpio: dwapb: Mask interrupts at hardware initialization - netfilter: ipset: mark the rcu locked areas properly - arm64: fixmap: Allow 256K early_ioremap() at any offset - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - wifi: mwifiex: replace one-element arrays with flexible array members - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ASoC: rt5645: Perform the initial jack detect at probe - clk: at91: pmc: #undef field_{get,prep}() before definition - Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" - Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - net: amd-xgbe: discard rx packets with bad FCS - OPP: of: Fix potential multiplication overflow when calculating freq - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Update to modern clocking terminology - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - tty: make tty_ldisc_ops::hangup return void - ppp: ppp_async: simplify tty disc_data access - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: remove platform_data support - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - ASoC: ux500: remove stedma40 references - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Program the MSP FIFO watermarks - btrfs: return an error from btrfs_record_root_in_trans - net/rds: use clear_bit_unlock() in release_refill() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net_sched: sch_fq_pie: implement lockless fq_pie_dump() - net/sched: pie: clamp psched_mtu in pie_drop_early - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - virtio-console: call scheduler when we free unused buffs - virtio-pci: return IRQ_HANDLED after non-zero ISR - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value - net: sun4i-emac: fix missing of_node_put() for phy_node - net/rds: Pass a pointer to virt_to_page() - Revert "bluetooth/l2cap: sync sock recv cb and release" - scsi: target: iscsi: Handle abort for WRITE_PENDING cmds - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - dm/amdgpu: fix malformed link_settings debugfs output - watchdog: sunxi_wdt: preserve boot-enabled watchdog - tunnels: Drop stale dst when building an ICMP error for PMTUD - exec: do_close_on_exec() before taking exec_update_lock - net: hso: fix TIOCMIWAIT race - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - KVM: PPC: Book3S HV: Set irqfd->producer only on success - s390/qeth: allow bridgeport queries despite OS_MISMATCH - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - mptcp: hold mptcp socket before calling tcp_done - Bluetooth: L2CAP: Fix deadlock - ARM: fix hash_name() fault - ARM: fix branch predictor hardening - ARM: ensure interrupts are enabled in __do_user_fault() - sunvdc: fix -EIO issue due to lack of retries - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: propagate extack to all netlink doit handlers - xfrm: add extack to verify_sec_ctx_len - xfrm: add extack support to verify_newsa_info - xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead - xfrm: avoid RCU warnings around the per-netns netlink socket - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Introduce siw_cep_set_free_and_put - RDMA/siw: Cleanup siw_accept - IB/iser: Align coding style across driver - IB/iser: Remove iser_reg_data_sg helper function - IB/iser: Use iser_fr_desc as registration context - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_close_session() - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_check_session_usage_count() - scsi: target: iscsi: Redo iscsit_check_session_usage_count() return code - scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-mapping: simplify dma_init_coherent_memory - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - keys: fix lost wakeup when reaping a dead key type - Input: trackpoint - fix the inertia attribute name in the ABI document - btrfs: tree-checker: print dev extent offset in error message - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - net: netsec: fix device_node reference leak on phy_np - Input: eeti_ts - publish the OF module alias - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - fix PDP Marvel Xbox 360 controller - net: xfrm: reject unrepresentable espintcp transport headers - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - net/packet: avoid truncating TPACKET_V3 private size - keys: translate request_key_auth pid for the reading procfs instance - i2c: at91: release DMA channels on remove and probe error - i2c: imx: release DMA channels on probe error - selinux: always fill AVC decision in avc_has_perm_noaudit() - mmc: core: Fix OF node reference leak on card add failure - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: sdhci_am654: Reset command and data lines on failed tuning - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - hwmon: (w83793) release probe data through kref - watchdog: digicolor: Avoid division by zero - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - wifi: rsi: fix heap OOB write on key removal - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - spi: zynqmp-gqspi: Use devm_spi_alloc_host() - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc - bpf: Fix out-of-bounds read of rtt_min in sock_ops - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - Bluetooth: SMP: reject Security Request over BR/EDR - s390/pci: expose UID uniqueness guarantee - Documentation: s390: correct spelling - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - xsk: Use a 32-bit compare in xsk_map_gen_lookup - netfilter: flowtable: allow unidirectional rules - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - sctp: avoid livelock while updating retransmit path - net: usb: catc: bound the RX packet length in catc_rx_done() - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - net: usb: sr9700: include receive overhead in the length check - tg3: clean up PHYLIB resources on probe failure - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - bpf: Fix bpf_sock context code generation - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: Remove some unnecessary void pointers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: remove redundant assignment to variable i - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - nfc: llcp: Fix race condition in accept_queue lifecycle - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - net/sched: act_gate: budget the per-entry list in get_fill_size - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - ip_gre: Reject enabling collect metadata through changelink - net: xps: reject an out of range traffic class - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - rculist: add list_splice_rcu() for private lists - net: add and use skb_unclone_keeptruesize() helper - net: add skb_set_end_offset() helper - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - workqueue: Fix NULL current_pwq deref in flush dependency check - fsl/fman: Fix clk reference leak in read_dts_node() - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - rds: ib: Clear the sg list when mapping an MR fails - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - pinctrl: single: free the IRQ on domain creation failure - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected - lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected - Linux 5.10.271 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Update to upstream stable Linux 5.10.271 (from 5.10.270). * Bump kernel ABI to 50: ship the ELS kernel as 5.10.0-50-*, distinct from the prior 5.10.0-49. * CVE-2022-48816 - SUNRPC: lock against ->sock changing during sysfs read {CVE-2022-48816} * CVE-2022-49142 - net: preserve skb_end_offset() in skb_unclone_keeptruesize() {CVE-2022-49142} * CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406} * CVE-2023-53707 - drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 {CVE-2023-53707} * CVE-2024-41062 - Reapply "bluetooth/l2cap: sync sock recv cb and release" {CVE-2024-41062} * CVE-2024-47408 - net/smc: check smcd_v2_ext_offset when receiving proposal msg {CVE-2024-47408} * CVE-2024-49568 - net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg {CVE-2024-49568} * CVE-2024-56545 - HID: hyperv: streamline driver probe to avoid devres issues {CVE-2024-56545} * CVE-2025-21759 - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2026-52988 - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase {CVE-2026-52988} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} * CVE-2026-74460 - can: ems_usb: validate CPC message lengths {CVE-2026-74460} * CVE-2026-74496 - fou: Fix use-after-free in fou_create() {CVE-2026-74496} * CVE-2026-74743 - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} * CVE-2026-80833 - crypto: sun8i-ss - Remove crypto_rng interface {CVE-2026-80833} * CVE-2026-80834 - crypto: sun8i-ce - Remove crypto_rng interface {CVE-2026-80834} * CVE-2026-90304 - ARM: 9484/1: enable interrupts when unhandled user faults are triggered {CVE-2026-90304} * CVE-2026-93204 - batman-adv: dat: atomically update mac addresses {CVE-2026-93204} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287} * CVE-2026-93782 - vhost-scsi: flush backend after device ioctls {CVE-2026-93782} * CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783} * CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() {CVE-2026-93784} * CVE-2026-93785 - cifs: validate idmap key payload length {CVE-2026-93785} * CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser {CVE-2026-93789} * CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure {CVE-2026-93795} * CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check {CVE-2026-93797} * CVE-2026-93798 - btrfs: fix reloc root cleanup in merge_reloc_roots() {CVE-2026-93798} * CVE-2026-93800 - btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() {CVE-2026-93800} * CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807} * CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808} * CVE-2026-93815 - net: au1000: move free_irq out of the close-time spinlocked section {CVE-2026-93815} * CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion {CVE-2026-93816} * CVE-2026-93819 - PCI: mediatek: Protect root bus removal with rescan lock {CVE-2026-93819} * CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock {CVE-2026-93820} * CVE-2026-93821 - PCI: altera: Protect root bus removal with rescan lock {CVE-2026-93821} * CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} * CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} * CVE-2026-97407 - ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt {CVE-2026-97407} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-97411 - net: ibm: emac: mal: fix potential system hang in mal_remove() {CVE-2026-97411} * CVE-2026-97416 - btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() {CVE-2026-97416} * CVE-2026-97417 - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} * CVE-2026-97418 - ALSA: es18xx: check control allocation before private data setup {CVE-2026-97418} * CVE-2026-97419 - hsr: broadcast netlink notifications in the device's net namespace {CVE-2026-97419} * CVE-2026-97420 - bpf: NUL-terminate replaced sysctl value {CVE-2026-97420} * CVE-2026-97430 - xhci: Prevent queuing new commands if xhci is inaccessible {CVE-2026-97430} * CVE-2026-97435 - net: dsa: sja1105: flower: reject cross-chip redirect {CVE-2026-97435} * CVE-2026-97440 - net: qrtr: fix node refcount leak on ctrl packet alloc failure {CVE-2026-97440} * CVE-2026-97441 - ata: ahci: fail probe if BAR too small for claimed ports {CVE-2026-97441} * CVE-2026-97443 - perf/ftrace: Fix WARNING in __unregister_ftrace_function {CVE-2026-97443} * CVE-2026-97444 - ACPICA: add boundary checks in two places {CVE-2026-97444} * CVE-2026-97445 - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} * CVE-2026-97446 - ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() {CVE-2026-97446} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97449 - ACPICA: Add package limit checks in parser functions {CVE-2026-97449} * CVE-2026-97450 - ACPICA: validate handler object type in two places {CVE-2026-97450} * CVE-2026-97451 - ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) {CVE-2026-97451} * CVE-2026-97452 - ACPICA: Prevent adding invalid references {CVE-2026-97452} * CVE-2026-97453 - ACPICA: validate byte_count in acpi_ps_get_next_package_length() {CVE-2026-97453} * CVE-2026-97454 - ACPICA: add boundary checks in acpi_ps_get_next_field() {CVE-2026-97454} * CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} * CVE-2026-97456 - ACPICA: Fix condition check in acpi_ps_parse_loop() {CVE-2026-97456} * CVE-2026-97472 - ipv6: addrconf: fix temp address generation after prefix deprecation {CVE-2026-97472} * CVE-2026-97475 - thermal/drivers/tegra/soctherma: Switch to devm cooling device registration {CVE-2026-97475} * CVE-2026-97476 - rds: filter RDS_INFO_* getsockopt by caller's netns {CVE-2026-97476} * CVE-2026-97481 - serial: 8250: fix possible ISR soft lockup {CVE-2026-97481} * CVE-2026-97482 - usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log {CVE-2026-97482} * CVE-2026-97483 - usb: core: hcd: fix possible deadlock in rh control transfers {CVE-2026-97483} * CVE-2026-97484 - usbip: vhci_hcd: fix NULL deref in status_show_vhci {CVE-2026-97484} * CVE-2026-97485 - omfs: handle set_blocksize failures {CVE-2026-97485} * CVE-2026-97486 - hpfs: handle set_blocksize failures {CVE-2026-97486} * CVE-2026-97487 - jfs: handle set_blocksize failures {CVE-2026-97487} * CVE-2026-97488 - qnx4: handle set_blocksize failures {CVE-2026-97488} * CVE-2026-97489 - bfs: handle set_blocksize failures {CVE-2026-97489} * CVE-2026-97490 - affs: handle set_blocksize failures {CVE-2026-97490} * CVE-2026-97491 - net/rds: Don't sleep inside rds_ib_conn_path_shutdown {CVE-2026-97491} * CVE-2026-97492 - wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed {CVE-2026-97492} * CVE-2026-97502 - mmc: davinci: avoid NULL deref of host->data in IRQ handler {CVE-2026-97502} * CVE-2026-97507 - media: dm1105: fix missing error check for dma_alloc_coherent {CVE-2026-97507} * CVE-2026-97508 - thunderbolt: Set tb->root_switch to NULL when domain is stopped {CVE-2026-97508} * CVE-2026-97510 - thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() {CVE-2026-97510} * CVE-2026-97523 - mptcp: close race between scheduler and state change {CVE-2026-97523} * CVE-2026-97524 - mptcp: avoid unneeded actions on subflow reset {CVE-2026-97524} * CVE-2026-97568 - mptcp: syncookies: remember the request backup flag {CVE-2026-97568} * CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() {CVE-2026-97572} * CVE-2026-97573 - bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() {CVE-2026-97573} * CVE-2026-97592 - s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm {CVE-2026-97592} * CVE-2026-97596 - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} * CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation {CVE-2026-97598} * CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink {CVE-2026-97601} * CVE-2026-97604 - fbdev: vfb: defer cleanup until the last reference {CVE-2026-97604} * CVE-2026-97611 - net: openvswitch: fix use-after-free of the flow table mask array {CVE-2026-97611} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-97899 - drm/i915: Fix memory leak in query_perf_config_list() {CVE-2026-97899} * CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication {CVE-2026-97904} * CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication {CVE-2026-97905} * CVE-2026-97909 - ASoC: sti: initialize IRQ lock before requesting IRQ {CVE-2026-97909} * CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations {CVE-2026-97910} * CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails {CVE-2026-97923} * CVE-2026-97926 - ufs: validate cylinder group metadata before caching it {CVE-2026-97926} * CVE-2026-97927 - ufs: create the root dentry after loading cylinder metadata {CVE-2026-97927} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97948 - powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver {CVE-2026-97948} * CVE-2026-97951 - scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands {CVE-2026-97951} * CVE-2026-97952 - sunvdc: unmap LDC cookies when the descriptor send fails {CVE-2026-97952} * CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954} * CVE-2026-97957 - net: hinic: fix mailbox segment buffer overflow {CVE-2026-97957} * CVE-2026-97958 - net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). {CVE-2026-97958} * CVE-2026-97959 - net/sched: cls_route: free emptied bucket on filter move {CVE-2026-97959} * CVE-2026-97981 - net: ethernet: cortina: Count dropped frames as NAPI work {CVE-2026-97981} * CVE-2026-97982 - net: ethernet: cortina: Fix budget accounting {CVE-2026-97982} * CVE-2026-97993 - vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx {CVE-2026-97993} * CVE-2026-97995 - virtio_console: do not free control-out buffers on remove {CVE-2026-97995} * CVE-2026-97998 - netfilter: nfnetlink_log: cope with concurrent instance destruction {CVE-2026-97998} * CVE-2026-98006 - ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev {CVE-2026-98006} * CVE-2026-98009 - net/sched: ets: clamp quantum in parse and fallback paths {CVE-2026-98009} * CVE-2026-98010 - net/sched: drr: clamp quantum in change class {CVE-2026-98010} * CVE-2026-98011 - net/sched: hhf: clamp quantum in change and init paths {CVE-2026-98011} * CVE-2026-98012 - net/sched: sfq: clamp quantum in change path {CVE-2026-98012} * CVE-2026-98013 - net/sched: fq_pie: clamp quantum in change path {CVE-2026-98013} * CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} * CVE-2026-98022 - net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations {CVE-2026-98022} * CVE-2026-98023 - vxlan: reject dynamic fdb entries that reference a nexthop id {CVE-2026-98023} * CVE-2026-98025 - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} * CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027} * CVE-2026-98030 - net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size {CVE-2026-98030} * CVE-2026-98063 - bpf: Fix NULL-ptr-deref in btf_var_show() {CVE-2026-98063} * CVE-2026-98064 - bpf: Fix NULL-ptr-deref when showing a void BTF type {CVE-2026-98064} * CVE-2026-98066 - ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066} * CVE-2026-98068 - net/rds: don't let rds_conn_shutdown() consume a concurrent drop {CVE-2026-98068} * CVE-2026-98069 - net/rds: acquire the fastpath locks in rds_conn_shutdown() {CVE-2026-98069} * CVE-2026-98070 - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() {CVE-2026-98070} * CVE-2026-98071 - net/rds: clear cp_flags bits individually in rds_conn_path_reset() {CVE-2026-98071} * CVE-2026-98072 - net/rds: use wq_has_sleeper() in release_in_xmit() {CVE-2026-98072} * CVE-2026-98074 - bonding: do not clear curr_active_slave prematurely when releasing all slaves {CVE-2026-98074} * CVE-2026-98076 - tracing/probes: Fix use-after-free on field name/type of events with multiple probes {CVE-2026-98076} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-98078 - ipvs: fix reversed sequence option serialization {CVE-2026-98078} * CVE-2026-98080 - btrfs: do not force reloc root creation during qgroup_account_snapshot() {CVE-2026-98080} * CVE-2026-98091 - btrfs: detach failed sprout device from transaction update list {CVE-2026-98091} * CVE-2026-98094 - staging: fbtft: make dirty_lock IRQ-safe {CVE-2026-98094} * CVE-2026-98095 - af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). {CVE-2026-98095} * CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} * CVE-2026-98108 - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} * CVE-2026-98123 - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration {CVE-2026-98123} * CVE-2026-98130 - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} * CVE-2026-98157 - EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation {CVE-2026-98157} * CVE-2026-98158 - ppp_async: drop the errored frame instead of resetting its headroom {CVE-2026-98158} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-98186 - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186} * CVE-2026-98187 - wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST {CVE-2026-98187} * CVE-2026-98188 - wifi: p54: validate curve data length in the calibration curve converters {CVE-2026-98188} * CVE-2026-98189 - wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() {CVE-2026-98189} * CVE-2026-98190 - wifi: wilc1000: fix out-of-bounds read in P2P public action frames {CVE-2026-98190} * CVE-2026-98191 - wifi: wlcore: release runtime PM ref on regdomain config failure {CVE-2026-98191} * CVE-2026-98194 - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} * CVE-2026-98195 - wifi: iwlegacy: fix broadcast stations deallocation {CVE-2026-98195} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-98197 - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} * CVE-2026-98201 - Input: zero ff_effect before compat copy in input_ff_effect_from_user {CVE-2026-98201} * CVE-2026-98202 - Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound {CVE-2026-98202} * CVE-2026-98203 - Input: soc_button_array - check btns_desc->package.count {CVE-2026-98203} * CVE-2026-98204 - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() {CVE-2026-98204} * CVE-2026-98205 - Input: evdev - zero absinfo before partial copy in EVIOCSABS {CVE-2026-98205} * CVE-2026-98207 - mmc: spi: reset bytes_xfered before retrying CRC failures {CVE-2026-98207} * CVE-2026-98208 - mmc: sdio_uart: fix xmit_fifo leak when the port table is full {CVE-2026-98208} * CVE-2026-98209 - mmc: sdhci-of-aspeed: Remove children before releasing SDC resources {CVE-2026-98209} * CVE-2026-98210 - mmc: mxcmmc: cancel data work and watchdog on remove {CVE-2026-98210} * CVE-2026-98217 - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} * CVE-2026-98233 - net/packet: clear RX owner on VNET header error {CVE-2026-98233} * CVE-2026-98234 - net/sched: hhf: cap hh_flows_limit at change time {CVE-2026-98234} * CVE-2026-98241 - ipv6: xfrm: use full sockets in local error paths {CVE-2026-98241} * CVE-2026-98251 - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} * CVE-2026-98252 - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() {CVE-2026-98252} * CVE-2026-98253 - RDMA/ucma: Serialize join and leave on copy_to_user failure {CVE-2026-98253} * CVE-2026-98255 - tcp: exclude old ACKs from tcp fast path {CVE-2026-98255} * CVE-2026-98257 - rds: ib: use rds_conn_drop() on protocol version mismatch {CVE-2026-98257} * CVE-2026-98262 - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} * CVE-2026-98272 - net: mvpp2: prevent buffer overflow in page_pool allocation {CVE-2026-98272} * CVE-2026-98275 - net: ethernet: cortina: Ack RX overrun interrupt correctly {CVE-2026-98275} * CVE-2026-98276 - net: lock the socket in sock_gettstamp() {CVE-2026-98276} * CVE-2026-98282 - powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba {CVE-2026-98282} * CVE-2026-98298 - dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() {CVE-2026-98298} * CVE-2026-98299 - tcp: do not let tcp_rmem be set below 4096 {CVE-2026-98299} * CVE-2026-98300 - tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). {CVE-2026-98300} * CVE-2026-98302 - net: fddi: skfp: fix NULL deref when setting the MAC address while down {CVE-2026-98302} * CVE-2026-98306 - seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation {CVE-2026-98306} * CVE-2026-98308 - ALSA: hda: trace PCM open only after assigning a stream {CVE-2026-98308} * CVE-2026-98311 - wifi: virt_wifi: don't transfer operstate before register {CVE-2026-98311} * CVE-2026-98314 - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} * CVE-2026-98319 - drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr {CVE-2026-98319} * CVE-2026-98320 - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} * CVE-2026-98322 - netfilter: nft_nat: fully initialise new_addr in netmap setup {CVE-2026-98322} * CVE-2026-98323 - RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323} * CVE-2026-98339 - wifi: cfg80211: don't filter by BSS type when removing stale entries {CVE-2026-98339} * CVE-2026-98340 - wifi: cfg80211: only group hidden BSSes with beacon entries {CVE-2026-98340} * CVE-2026-98342 - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} * CVE-2026-98343 - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} * CVE-2026-98344 - dmaengine: Fix device kref underflow in dma_chan_put() {CVE-2026-98344} * CVE-2026-98345 - wifi: cfg80211: check IP header size in cfg80211_classify8021d() {CVE-2026-98345} * CVE-2026-98347 - IB/IPoIB: Avoid restoring OPER_UP after multicast flush {CVE-2026-98347} * CVE-2026-98348 - wifi: libipw: reject too-short association responses {CVE-2026-98348} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98351 - wifi: virt_wifi: free skb when disconnected {CVE-2026-98351} * CVE-2026-98354 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} * CVE-2026-98357 - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} * CVE-2026-98358 - IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358} * CVE-2026-98362 - clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate {CVE-2026-98362} * CVE-2026-98363 - firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS {CVE-2026-98363} * CVE-2026-98367 - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} * CVE-2026-98370 - xfrm: fix compat ALLOCSPI request use-after-free {CVE-2026-98370} * CVE-2026-98379 - netfilter: ip6t_rpfilter: reject routes without inet6_dev {CVE-2026-98379} * CVE-2026-98380 - net/sched: reject IDR error pointers when deleting actions {CVE-2026-98380} * CVE-2026-98383 - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL {CVE-2026-98383} * Miscellaneous upstream changes - ima: return error early if file xattr cannot be changed - tee: optee: Allow MT_NORMAL_TAGGED shared memory - PCI: Stop setting cached power state to 'unknown' on unbind - hfsplus: fix issue of direct writes beyond end-of-file - wifi: mac80211: always allow transmitting null-data on TXQs - kcsan: Silence -Wmaybe-uninitialized when calling __kcsan_check_access() - bridge: Do not suppress ARP probes and DAD NS unconditionally - soundwire: validate DT compatible before parsing it - media: rc: mceusb: Add support for 04eb:e033 - thunderbolt: Keep the domain reference while processing hotplug - net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family - net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family - media: em28xx-video: fix missing res_free() on init_usb_xfer failure - clk: renesas: cpg-mssr: Add number of clock cells check - ASoC: ti: omap3pandora: update board check to use DT compatible - drm/amd/display: Fix CRC open failure during active rendering - hfsplus: rework hfsplus_readdir() logic - scsi: pm8001: Reject firmware update in fatal error state - scsi: pm8001: Reject non-fatal dump when controller is crashed - crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y - crypto: atmel-ecc - add support for atecc608b - media: imon: Add iMON VFD HID OEM v1.2 key mappings - RDMA/mlx5: Use QP port when decoding responder CQEs - mailbox: Make mbox_send_message() return error code when tx fails - ALSA: usx2y: Drain pending US-428 pipe-4 output commands - 9p: invalidate readdir buffer on seek - arm64/daifflags: Make local_daif_*() helpers __always_inline - firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size - bitfield: wire __bf_shf to __builtin_ctzll - net: usb: qmi_wwan: add MeiG SRM813Q - net: bridge: remove stale rcu_barrier() in br_multicast_dev_del() - net/sched: sch_drr: make cl->quantum lockless - befs: handle set_blocksize failures - minix: handle set_blocksize failures - isofs: handle set_blocksize failures - usb: host: add ARCH_AIROHA in XHCI MTK dependency - char/nvram: Remove redundant nvram_mutex - netlabel: fix IPv6 unlabeled address add error handling - rds: annotate data-race around rs_seen_congestion - s390/zcore: Removed unused variables - clk: socfpga: agilex: implement l3_main_free_clk - drm/panel: simple: Add AM-1280800W8TZQW-T00H - mips: cps: Assemble jr.hb with an R2 ISA level - iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind - irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed - ALSA: usb-audio: Add quirk for Novation Mininova - drm/amd/pm/si: Fix updating clock limits from power states - ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg() - hfs: rework hfsplus_readdir() logic - scripts: modpost: detect and report truncated buf_printf() output - ASoC: Intel: catpt: Complete coredump handling - soundwire: only handle alert events when the peripheral is attached - mmc: davinci: fix mmc_add_host order in probe - iio: accel: mma8452: switch to non-devm request_threaded_irq() - net: ibm: emac: Reserve VLAN header in MJS limit - ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive - iommu/rockchip: disable fetch dte time limit - ASoC: codecs: rk3328: Use managed GPIO and clock helpers - ALSA: seq: oss: Reject reads that cannot fit the next event - clk: keystone: don't cache clock rate - ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP - ipmi: si: Use platform_get_irq_optional() to retrieve interrupt - wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications - RDMA/mlx5: Fix state and counter desync on loopback enable failure - net: cpsw_new: unregister devlink on port registration failure - xprtrdma: Add request-pool slack for delayed recycling - configfs_depend_prep(): pass configfs_dirent instead of dentry - platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table - wifi: mt76: transform aspm_conf for pci_disable_link_state - hwmon: (adt7462) Add of_match_table to support devicetree - ata: libata-pmp: add JMicron JMS562 quirk - platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table - sctp: Unwind address notifier registration on failure - PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems - hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i - ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence - ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure - sparc64: uprobes: add missing break - vsock: use sk_acceptq_is_full() helper in all transports - e1000e: limit endianness conversion to boundary words - net/sched: act_csum: don't mangle UDP tunnel GSO packets - sparc: Disable compat support with LLD - fuse: set ff->flock only on success - scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() - gpio: pisosr: Read "ngpios" as u32 - ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10 - leds: uleds: Return -EFAULT on copy_to_user() failure - leds: pca9532: Don't stop blinking for non-zero brightness - ALSA: usb-audio: Add quirk for YAMAHA CDS3000 - md/raid5: let stripe batch bm_seq comparison wrap-safe - rtc: aspeed: add AST2700 compatible - PCI/sysfs: Use kstrtobool() to parse the ROM attribute input - rtc: bq32000: add delay between RTC reads - fbdev: pm2fb: unwind WC setup on probe failure - drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend - netfilter: nf_conntrack_expect: zero at allocation time - drm/arm/komeda: fix error handling for clk_prepare_enable() and callers - xen/front-pgdir-shbuf: free grant reference head on errors - freevxfs: don't BUG() on unknown typed-extent type - xen/gntalloc: validate grant count before allocation - wifi: ralink: RT2X00: init EEPROM properly - wifi: mac80211: validate deauth frame length before reason access - wifi: libertas: reject short monitor TX frames - gpio: dwapb: Mask interrupts at hardware initialization - netfilter: ipset: mark the rcu locked areas properly - arm64: fixmap: Allow 256K early_ioremap() at any offset - arm64: kprobes: Allow reentering kprobes while single-stepping - drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized - wifi: mwifiex: replace one-element arrays with flexible array members - wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO - drm/gma500: return errors from Oaktrail HDMI I2C reads - phonet: check register_netdevice_notifier() error in phonet_device_init() - ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx - ice: pass the return value of skb_checksum_help() - powerpc/pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash - ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision) - ASoC: rt5645: Perform the initial jack detect at probe - clk: at91: pmc: #undef field_{get,prep}() before definition - Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU" - Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU" - drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() - selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter - net/sched: act_api: budget all shared attributes in notify skbs - net/sched: act_api: size the RTM_GETACTION reply from the actions - net: amd-xgbe: discard rx packets with bad FCS - OPP: of: Fix potential multiplication overflow when calculating freq - Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM - Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout() - ASoC: ab8500: Reset the audio block before configuring it - ASoC: ab8500: Repair the DAPM capture graph - ASoC: ab8500: Update to modern clocking terminology - ASoC: ab8500: Correct digital interface format setup - ASoC: ab8500: Validate and program TDM slots correctly - tty: make tty_ldisc_ops::hangup return void - ppp: ppp_async: simplify tty disc_data access - ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits - ASoC: ux500: Fix MSP stream lifecycle handling - ASoC: ux500: remove platform_data support - ASoC: ux500: Propagate MSP setup errors - ASoC: ux500: Correct MSP frame and bit clock setup - ASoC: ux500: Validate MSP DAI configuration - ASoC: ux500: remove stedma40 references - ASoC: ux500: Request the MSP MMIO resource - ASoC: ux500: Program the MSP FIFO watermarks - btrfs: return an error from btrfs_record_root_in_trans - net/rds: use clear_bit_unlock() in release_refill() - net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown - net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset - bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit() - powerpc/kexec_file: Use inclusive range checks in add_usable_mem() - net/mlx5e: Fix setting RS FEC after remapping - net/mlx5e: Fix ETS zero BW reporting when one TC holds 100% - net_sched: sch_fq_pie: implement lockless fq_pie_dump() - net/sched: pie: clamp psched_mtu in pie_drop_early - ASoC: bcm: bcm63xx: Publish the OF module aliases - ASoC: Intel: SST: Publish the PCI module aliases - netfilter: ip6_tables: set F_PROTO when proto value is nonzero - ASoC: mt6351: Publish the OF module alias - virtio-console: call scheduler when we free unused buffs - virtio-pci: return IRQ_HANDLED after non-zero ISR - net: ethernet: cortina: Finish RX updates before NAPI completion - net: ethernet: cortina: No mapping is a dropped rx - net: ethernet: cortina: Count RX drops once per frame - net: ethernet: cortina: Count RX descriptors for freeq refill - hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown() - hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors - selftests/powerpc/tm: Fix tcheck() reading uninitialised CR value - net: sun4i-emac: fix missing of_node_put() for phy_node - net/rds: Pass a pointer to virt_to_page() - Revert "bluetooth/l2cap: sync sock recv cb and release" - scsi: target: iscsi: Handle abort for WRITE_PENDING cmds - ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough - dm/amdgpu: fix malformed link_settings debugfs output - watchdog: sunxi_wdt: preserve boot-enabled watchdog - tunnels: Drop stale dst when building an ICMP error for PMTUD - exec: do_close_on_exec() before taking exec_update_lock - net: hso: fix TIOCMIWAIT race - netfilter: report NLM_F_DUMP_FILTERED when all is filtered out - KVM: PPC: Book3S HV: Set irqfd->producer only on success - s390/qeth: allow bridgeport queries despite OS_MISMATCH - hwmon: (applesmc) fix key backlight workqueue leak on register failure - hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS - media: hevc: add bounded tile-count helpers - media: v4l2-h264: Fix memcmp() size in B1 reference list comparison - netfilter: nft_set_pipapo_avx2: add missing vzeroupper - mptcp: hold mptcp socket before calling tcp_done - Bluetooth: L2CAP: Fix deadlock - ARM: fix hash_name() fault - ARM: fix branch predictor hardening - ARM: ensure interrupts are enabled in __do_user_fault() - sunvdc: fix -EIO issue due to lack of retries - media: video-i2c: fix buffer queue ordering - ipv6: Select best matching nexthop object in fib6_table_lookup() - ipv6: Honor oif when choosing nexthop for locally generated traffic - xfrm: propagate extack to all netlink doit handlers - xfrm: add extack to verify_sec_ctx_len - xfrm: add extack support to verify_newsa_info - xfrm: add extack to verify_one_alg, verify_auth_trunc, verify_aead - xfrm: avoid RCU warnings around the per-netns netlink socket - ARM: socfpga: select the PL310 erratum 753970 workaround - RDMA/siw: Introduce siw_cep_set_free_and_put - RDMA/siw: Cleanup siw_accept - IB/iser: Align coding style across driver - IB/iser: Remove iser_reg_data_sg helper function - IB/iser: Use iser_fr_desc as registration context - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_close_session() - scsi: target: iscsi: Avoid in_interrupt() usage in iscsit_check_session_usage_count() - scsi: target: iscsi: Redo iscsit_check_session_usage_count() return code - scsi: target: iscsi: Rename iscsi_cmd to iscsit_cmd - dmaengine: sprd: Fix runtime PM reference leak in probe - wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path - soundwire: cadence_master: wait and cancel cdns->work before clock stop - MIPS: Octeon: apply USB FDT fixups also when USB is modular - dma-mapping: simplify dma_init_coherent_memory - dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask - dma-coherent: report a failed reserved memory assignment - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown - wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set - wifi: mac80211: don't access the TSF of a down interface - dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order - dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA - keys: fix lost wakeup when reaping a dead key type - Input: trackpoint - fix the inertia attribute name in the ABI document - btrfs: tree-checker: print dev extent offset in error message - wifi: brcmfmac: fix lost 802.1x TX completion wakeup - Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown - drop_monitor: synchronize tracepoint unregistration on error path - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() - KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure - ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments - net: netsec: fix device_node reference leak on phy_np - Input: eeti_ts - publish the OF module alias - Input: xpad - add support for Victrix Pro BFG Controller - Input: xpad - fix PDP Marvel Xbox 360 controller - net: xfrm: reject unrepresentable espintcp transport headers - arm64: percpu: Fix this_cpu_write() casting - arm64: percpu: Fix this_cpu_and() mask generation - Bluetooth: btusb: fix NXP IW610 composite device handling - dmaengine: sun6i: fix non-atomic read of DMA position registers - dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status - dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() - net/packet: avoid truncating TPACKET_V3 private size - keys: translate request_key_auth pid for the reading procfs instance - i2c: at91: release DMA channels on remove and probe error - i2c: imx: release DMA channels on probe error - selinux: always fill AVC decision in avc_has_perm_noaudit() - mmc: core: Fix OF node reference leak on card add failure - mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt - mmc: sdhci_am654: Reset command and data lines on failed tuning - Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026 - Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P - Input: soc_button_array - fix MS Surface Pro 11 probe failure - Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722) - hwmon: (w83793) release probe data through kref - watchdog: digicolor: Avoid division by zero - watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init() - wifi: rsi: fix heap OOB write on key removal - wifi: mwifiex: validate action frame fixed fields - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver - drm/msm/adreno: fix autosuspend cleanup during teardown - drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure - HID: logitech-hidpp: fix race condition when accessing stale stack pointer - spi: zynqmp-gqspi: Use devm_spi_alloc_host() - bpf: Fix bpf_skb_change_tail wrt csum partial skbs - selftests/ftrace: Fix unique symbol check in kprobe_non_uniq_symbol.tc - bpf: Fix out-of-bounds read of rtt_min in sock_ops - squashfs: Add dictionary size range check to prevent shift-out-of-bounds - Bluetooth: SMP: reject Security Request over BR/EDR - s390/pci: expose UID uniqueness guarantee - Documentation: s390: correct spelling - docs: s390/pci: Improve and update PCI documentation - s390/pci/docs: Fix sriov_numvfs attribute name - xsk: Use a 32-bit compare in xsk_map_gen_lookup - netfilter: flowtable: allow unidirectional rules - netfilter: flowtable: publish HW_DEAD after worker is done - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier - netfilter: nft_synproxy: use the family-aware checksum helper - ipvs: revalidate ihl before icmp_send - ocfs2: make ocfs2_calc_xattr_init() return void - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update - drm/nouveau/clk: don't clobber reclock status when restoring volt/fan - net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure - net: gue: reject invalid REMCSUM offsets - ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink(). - sctp: avoid livelock while updating retransmit path - net: usb: catc: bound the RX packet length in catc_rx_done() - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget - drm/virtio: fix object leak when drm_gem_handle_create() fails - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough - Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() - net: usb: sr9700: include receive overhead in the length check - tg3: clean up PHYLIB resources on probe failure - net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error - bpf: Fix bpf_sock context code generation - net: stmmac: selftests: Support running selftests on DSA conduits - net: stmmac: selftests: Check the dev->features for S-TAG offload testing - net: stmmac: selftests: Capture all packets for vlan checks - net: stmmac: Remove some unnecessary void pointers - net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K - nfc: nfcmrvl: validate helper command length before pull - nfc: st21nfca: remove redundant assignment to variable i - nfc: st21nfca: validate received frame size - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() - nfc: llcp: Fix race condition in accept_queue lifecycle - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure - nfc: st21nfca: validate ISO15693 inventory length - nfc: llcp: fix -ENOMEM on connect with zero-length service name - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() - nfc: llcp: fix slab-out-of-bounds reads when logging service names - nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() - net/sched: act_gate: budget the per-entry list in get_fill_size - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() - ip_gre: Reject enabling collect metadata through changelink - net: xps: reject an out of range traffic class - tipc: Fix a data race on mon->peer_cnt in mon_timeout() - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure - bridge: check llc_mac_hdr_init() return value in br_send_bpdu() - net/sched: sch_teql: fix shadowed err in __teql_resolve() - vlan: ensure sufficient headroom in vlan_dev_hard_header() - autofs: fix sbi->pipe file reference leak in autofs_kill_sb() - rculist: add list_splice_rcu() for private lists - net: add and use skb_unclone_keeptruesize() helper - net: add skb_set_end_offset() helper - x86/PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11 - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow - sctp: discard the rest of the packet on a stale-cookie error - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT - workqueue: Fix NULL current_pwq deref in flush dependency check - fsl/fman: Fix clk reference leak in read_dts_node() - ipv6: do not let ipv6_find_hdr() return an offset past the packet end - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST - gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() - gpio: zynq: fix runtime PM leak on request error path - llc: reserve device headroom for allocated frames - rds: ib: Clear the sg list when mapping an MR fails - drm/nouveau: fix autosuspend cleanup during teardown - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() - drm/nouveau: fix double-free in nvif_vmm_dtor - drm/nouveau: Fix gem reference leak in validate_init() - HID: alps: fix use-after-free on input2 registration failure - HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() - net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() - net: arp: terminate device name before lookup - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read - net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy() - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry - net: atl1c: fix soft lockup on out-of-range tpd_cons read - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read - net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read - nfc: fix use-after-free in nfc_get_local_general_bytes - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() - nfc: port100: reject frames whose declared length exceeds the received data - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU - pinctrl: single: free the IRQ on domain creation failure - s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() - Bluetooth: hci_sock: validate event length before filtering - Bluetooth: hci_sock: reject out-of-range OCF values - Bluetooth: L2CAP: validate frame length before control and FCS access - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO - lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected - lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected - Linux 5.10.271

0 tuxcare-debian11-els bpftool_5.10.271-1+tuxcare.els1_amd64.deb 2604a2ad37423acf906db37080d5b5d214166823 hyperv-daemons_5.10.271-1+tuxcare.els1_amd64.deb 35e60898b297a955e69a0eca7ea0173425f89b8e libcpupower-dev_5.10.271-1+tuxcare.els1_amd64.deb 8475288cc610e4c49d8963aafa8d53c485b565d8 libcpupower1_5.10.271-1+tuxcare.els1_amd64.deb 772b4fbbb6b114bbed3bd4cfbc1a356b0ea22d39 linux-compiler-gcc-10-x86_5.10.271-1+tuxcare.els1_amd64.deb 993990b4e261d47b2dc00ce9eb88c93bca01d158 linux-config-5.10_5.10.271-1+tuxcare.els1_amd64.deb a5024f762933ec07f22816449acff86e3fecfad8 linux-cpupower_5.10.271-1+tuxcare.els1_amd64.deb 6f2c99c41d1e708e4454129a12e5b12bc0c93d38 linux-doc_5.10.271-1+tuxcare.els1_all.deb ee38cb03854f724462e7f7b5640e5b6e9d5cd05b linux-doc-5.10_5.10.271-1+tuxcare.els1_all.deb ed5ebddf9168d4d405948cfe9ed7a1aefa86d8c9 linux-headers-5.10.0-50-amd64_5.10.271-1+tuxcare.els1_amd64.deb 727047cdf230ee0818028690fc00637a5df2731d linux-headers-5.10.0-50-common_5.10.271-1+tuxcare.els1_all.deb bc536dc3464df8dbc11438091da747c056bc01cf linux-headers-amd64_5.10.271-1+tuxcare.els1_amd64.deb 9a096214125e754ce20584f3948ec397205d3c51 linux-image-5.10.0-50-amd64-unsigned_5.10.271-1+tuxcare.els1_amd64.deb 1e02bd3196227c54076988739d660b278e9dbe85 linux-image-amd64_5.10.271-1+tuxcare.els1_amd64.deb f5e76b083147411500a01892b17a4b3c597754db linux-image-amd64-signed-template_5.10.271-1+tuxcare.els1_amd64.deb 5303195416c19e2622ce85fd83ddd4473fd17048 linux-kbuild-5.10_5.10.271-1+tuxcare.els1_amd64.deb 323be50daff3d1b2f04cf504bbb616b72e7265b1 linux-libc-dev_5.10.271-1+tuxcare.els1_amd64.deb 79eacb278b324885aa9eed46b9e159b95280e283 linux-perf_5.10.271-1+tuxcare.els1_amd64.deb 3e29e10f1c34340a7a01352a67438feb2df7cb4a linux-perf-5.10_5.10.271-1+tuxcare.els1_amd64.deb aa9316762c48ca33fecd5fa4c58fdc9e16aa5fb7 linux-source_5.10.271-1+tuxcare.els1_all.deb 85382fa7d7934e419dc0997154f8119061adba5f linux-source-5.10_5.10.271-1+tuxcare.els1_all.deb 0fe87548754d20e8760e63f04c8d6fa0e4d871e1 linux-support-5.10.0-50_5.10.271-1+tuxcare.els1_all.deb c3867e3e92cd2683a705afd6048f7f9852ba444e bpftool_5.10.271-1+tuxcare.els1_arm64.deb dd3ca66d939da67519fced2fc362c6737fd2fe48 hyperv-daemons_5.10.271-1+tuxcare.els1_arm64.deb e7eb844cfe0c54db4afa1aaaa60c4741e7539e50 libcpupower-dev_5.10.271-1+tuxcare.els1_arm64.deb f1c5ec5f4b086593f689a743838a7357871e903a libcpupower1_5.10.271-1+tuxcare.els1_arm64.deb 98c45c8940071b472e47e3f481b10f84a0d4c0ad linux-config-5.10_5.10.271-1+tuxcare.els1_arm64.deb f226fe973158f2df81c9bd0c982a549f7096843b linux-cpupower_5.10.271-1+tuxcare.els1_arm64.deb 901ef6dceb59698bd63a37afe6b370011f70a1d1 linux-headers-5.10.0-50-arm64_5.10.271-1+tuxcare.els1_arm64.deb e98b64a1e2c05fa3c2368c96ef68776aaad58947 linux-headers-arm64_5.10.271-1+tuxcare.els1_arm64.deb c28fd80716f1dd9aced3a77565d76c48da01ac15 linux-image-5.10.0-50-arm64-unsigned_5.10.271-1+tuxcare.els1_arm64.deb a44876c1ec1802ac5d9cb43099e53d53ddb101dd linux-image-arm64_5.10.271-1+tuxcare.els1_arm64.deb 048626e0e20582bc4743479bbadbf01d318f39d8 linux-image-arm64-signed-template_5.10.271-1+tuxcare.els1_arm64.deb fceb57ba51a0503e63dcb744d96580ae5311e522 linux-kbuild-5.10_5.10.271-1+tuxcare.els1_arm64.deb 2ee3456ee743ed8139975fd0886b5a3a97f5fbad linux-libc-dev_5.10.271-1+tuxcare.els1_arm64.deb 2614c76e2cbc187a1557ee999b983dd2d68cbd2d linux-perf_5.10.271-1+tuxcare.els1_arm64.deb f6be6b191565a56a4740eedb3e875873be361b56 linux-perf-5.10_5.10.271-1+tuxcare.els1_arm64.deb 5cd2a3f8913727291348d7ed9b94dc8b7d90680e bpftool_5.10.271-1+tuxcare.els1_armel.deb 9bda0037c6eb9acb3507bcaf9ae6f7b2e528f832 libcpupower-dev_5.10.271-1+tuxcare.els1_armel.deb 535bfae2d82cdb4612dc066203da9edcbc2232e9 libcpupower1_5.10.271-1+tuxcare.els1_armel.deb 5b5ad2c28721b444615039871afbca9bddc7b184 linux-compiler-gcc-10-arm_5.10.271-1+tuxcare.els1_armel.deb 7f72c788322a445383282044fe525d8bad6a225f linux-config-5.10_5.10.271-1+tuxcare.els1_armel.deb 7b749c6e6b58b539df70c110966902775534f49c linux-cpupower_5.10.271-1+tuxcare.els1_armel.deb 03157a0c0f10c6b50ee9243974f7487e4ae5a677 linux-headers-5.10.0-50-marvell_5.10.271-1+tuxcare.els1_armel.deb 3631c15c22bc6e69b8b134353c6778f534f2078a linux-headers-5.10.0-50-rpi_5.10.271-1+tuxcare.els1_armel.deb cbb3730294f01a659e77358920a16a7c6656d11a linux-headers-marvell_5.10.271-1+tuxcare.els1_armel.deb 2a0b43ffd5e930f4b76d070368a2e862bf3b57a9 linux-headers-rpi_5.10.271-1+tuxcare.els1_armel.deb bf4db615a5a2e3ecc629d92d8e1c25c0495d4691 linux-image-5.10.0-50-marvell_5.10.271-1+tuxcare.els1_armel.deb bde88a481f0320d7dee2e0acec04f5340b3585c6 linux-image-5.10.0-50-rpi_5.10.271-1+tuxcare.els1_armel.deb d6e79f1d1a6400c25e8b41ea0264377c50ead848 linux-image-marvell_5.10.271-1+tuxcare.els1_armel.deb 56fb48ca3d26a7dcb0a307db10b5a86cb3b3adc8 linux-image-rpi_5.10.271-1+tuxcare.els1_armel.deb 579d4a320cd706c491323b8b3cc8a059d093c304 linux-kbuild-5.10_5.10.271-1+tuxcare.els1_armel.deb bd9f2ff170634c5bb29225bafdc2484628de32e2 linux-libc-dev_5.10.271-1+tuxcare.els1_armel.deb 368b78c7d756b821bbb811fb248db5de3e7a5a7f linux-perf_5.10.271-1+tuxcare.els1_armel.deb b9fd880bdff1e3d3ec2cbb74e05fbf317b954530 linux-perf-5.10_5.10.271-1+tuxcare.els1_armel.deb c5f16877c4818d8e41ba5a8d652fff229bbe4251 CLSA-2026:1791927706 TuxCare License Agreement 0 * SECURITY UPDATE: packet over-reads in the mysqlnd wire protocol parser - debian/patches/CVE-2025-1218.patch: check the remaining packet size before each read in ext/mysqlnd/mysqlnd_wireprotocol.c, and check the field length against the field type in ext/mysqlnd/mysqlnd_ps_codec.c - CVE-2025-1218 * SECURITY UPDATE: heap buffer overflow in SOAP HTTP chunked responses - debian/patches/CVE-2025-14181.patch: use size_t lengths and checked reallocation for the response body in ext/soap/php_http.c - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection via unchecked entry size - debian/patches/CVE-2026-6103.patch: reject unrepresentable entry sizes and skip the data of every entry type that has data in ext/phar/tar.c - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in SOAP XML parsing and decoding - debian/patches/CVE-2026-91765.patch: walk XML nodes iteratively, reject documents nested deeper than 2048 levels and limit the decoding depth in ext/soap/php_xml.c and ext/soap/php_encoding.c - CVE-2026-91765 * SECURITY UPDATE: credentials leaked to another origin on HTTP redirects - debian/patches/CVE-2026-91766.patch: strip the Authorization, Cookie and Proxy-Authorization user headers when a redirect changes the scheme, host or port in ext/standard/http_fopen_wrapper.c - CVE-2026-91766 * SECURITY UPDATE: heap over-read in TLS wildcard certificate name matching - debian/patches/CVE-2026-91767.patch: include the wildcard prefix length in the subject length check in ext/openssl/xp_ssl.c - CVE-2026-91767 * SECURITY UPDATE: FastCGI allowed_clients matched IPv6 clients on a /96 prefix - debian/patches/CVE-2026-91768.patch: compare the full 16-byte IPv6 address in fcgi_is_allowed() in main/fastcgi.c - CVE-2026-91768 * SECURITY UPDATE: TLS peer name check fell back to the certificate CN when the certificate has a service identity - debian/patches/CVE-2026-91769.patch: do not fall back to the Common Name when the certificate has a DNS, URI or SRV subjectAltName in ext/openssl/xp_ssl.c - CVE-2026-91769 * SECURITY UPDATE: heap over-read in convert stream filters with a NUL byte in line-break-chars - debian/patches/CVE-2026-92842.patch: duplicate line-break-chars with pestrndup() in ext/standard/filters.c - CVE-2026-92842 * SECURITY UPDATE: heap over-read on an empty Location header in HTTP redirects - debian/patches/CVE-2026-93682.patch: use the stored Location length when resolving a relative redirect in ext/standard/http_fopen_wrapper.c - CVE-2026-93682 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: packet over-reads in the mysqlnd wire protocol parser - debian/patches/CVE-2025-1218.patch: check the remaining packet size before each read in ext/mysqlnd/mysqlnd_wireprotocol.c, and check the field length against the field type in ext/mysqlnd/mysqlnd_ps_codec.c - CVE-2025-1218 * SECURITY UPDATE: heap buffer overflow in SOAP HTTP chunked responses - debian/patches/CVE-2025-14181.patch: use size_t lengths and checked reallocation for the response body in ext/soap/php_http.c - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection via unchecked entry size - debian/patches/CVE-2026-6103.patch: reject unrepresentable entry sizes and skip the data of every entry type that has data in ext/phar/tar.c - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in SOAP XML parsing and decoding - debian/patches/CVE-2026-91765.patch: walk XML nodes iteratively, reject documents nested deeper than 2048 levels and limit the decoding depth in ext/soap/php_xml.c and ext/soap/php_encoding.c - CVE-2026-91765 * SECURITY UPDATE: credentials leaked to another origin on HTTP redirects - debian/patches/CVE-2026-91766.patch: strip the Authorization, Cookie and Proxy-Authorization user headers when a redirect changes the scheme, host or port in ext/standard/http_fopen_wrapper.c - CVE-2026-91766 * SECURITY UPDATE: heap over-read in TLS wildcard certificate name matching - debian/patches/CVE-2026-91767.patch: include the wildcard prefix length in the subject length check in ext/openssl/xp_ssl.c - CVE-2026-91767 * SECURITY UPDATE: FastCGI allowed_clients matched IPv6 clients on a /96 prefix - debian/patches/CVE-2026-91768.patch: compare the full 16-byte IPv6 address in fcgi_is_allowed() in main/fastcgi.c - CVE-2026-91768 * SECURITY UPDATE: TLS peer name check fell back to the certificate CN when the certificate has a service identity - debian/patches/CVE-2026-91769.patch: do not fall back to the Common Name when the certificate has a DNS, URI or SRV subjectAltName in ext/openssl/xp_ssl.c - CVE-2026-91769 * SECURITY UPDATE: heap over-read in convert stream filters with a NUL byte in line-break-chars - debian/patches/CVE-2026-92842.patch: duplicate line-break-chars with pestrndup() in ext/standard/filters.c - CVE-2026-92842 * SECURITY UPDATE: heap over-read on an empty Location header in HTTP redirects - debian/patches/CVE-2026-93682.patch: use the stored Location length when resolving a relative redirect in ext/standard/http_fopen_wrapper.c - CVE-2026-93682

0 tuxcare-debian11-els libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 685ef6b7d354498dfaf3de84e0300f543bd1042e libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb c7867fd60d199efaceab05c069c61e0d42ab80a9 php7.4_7.4.33-1+deb11u12+tuxcare.els1_all.deb 4d5fbd227216c5549e41f057443ee358315faad1 php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb d54b69027ee7d0bb4808a78e4377036e24883f61 php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb bfa6e41a45ce646934402498e601fb27fde4f41e php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 08e1b8254a3e5537a350c77ee7575f9e44094bcc php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 439b945db1e1d86e440969f932ea33c7b05e6024 php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 45c27c6520b55248bca2089b92aebe7c99a42dbf php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 03e60d2e64a595e35b0c46f0819b5182a31f0542 php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 4099f6ce960461781f7090d612f766eadc740142 php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 8cfcab4b282dcf28417c2c09ac11db460e15b1c1 php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 3a0a7f7ba1e13d04d5a2dc2bd4b421291661004e php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 5b07d508f754b1389ab3e433b95db68bdeff1f16 php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb f68a6d17f97faf08994bbc21091c6a40b1924c8e php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 542fb7bff56646ad938f7aab135025f7a1931ce2 php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 0fc17acc51bb2140f0624d2edafeaa2f77e9f7b6 php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb c29af33e6714f7b803f83e6c060f5bf3dd7e4ee5 php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 492971934f0568319c39e2a09502cdf5e4843385 php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 2c4e5b5eb5f5d6b5d7f2a1861252b240570427bd php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 5f1461d6fab330275c79ef1dd3528b61e1189a61 php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 147853a526cfd8495f6451c75097d4a3699df1c0 php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 4c1fe909b64f1f2f5cc1cb83ef4a36c63627952b php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 15da5dd87938adbbd1940b471f92fd45b6c149d3 php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 3688310f3c0c7e8c5806ed9ad0b88ecaa451a609 php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 55f61b7b12f47241e51157843c90cdb0ae69f1a6 php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 41a4496d53bb0ad684cef887a7cea589f6f118fa php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb ac54654511ae6b13b77ad7ac98384d67d252a9b3 php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 4ba881436b6ffb8b260bdf9b668c9710b05df9c2 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 6a02bb779cf6d7a09984411841e1ebaabed16d2e php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb b3856d8f325025457ab45394ea1b1775cf9e5a01 php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 26ca789f5c7a459840cfa76186ee0f95536ab5ec php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb a7333a1d3472f435480f261eacf1ad323c1a84f0 php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 23fd4c6ff4ffda05e0e4af8a44d0b4f01a3706d4 php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb 81652f4374ef2eafe7f46cfbdd1d066ab8601d91 php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb cb533b176a5dfc7d0f053df7aa1898d2734d24df php7.4-xsl_7.4.33-1+deb11u12+tuxcare.els1_all.deb 220cda275fa569ed568b2a58c7c431e1ce7aca3a php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_amd64.deb fe2d55673ee9afa865c60a736a1af49bb0ddd3ba libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb ce59db7c3195bd74f91f72b9eecff0628dfa0763 libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 04e16d5c5d3444658873a5bc6d9183baa5ac1345 php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb a550d73d4b25e3d945a7aa429de6128b42da0b97 php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb df83f829c48f53269c917b8a0b88381ae75bf44e php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 49b2baf16d9adc62e126de4217a949c23d62f71e php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb fc39b9a6460b653a2c6064432dc51bc08ff7e362 php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 24754d9d98a6ca09fcbf2dc37455ad05c1fba9c8 php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 8b891d288c2a9000b10036a03f9bcd8a0ab89c83 php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 30d62d80955fc4b46bffa49f59d328ab5fe84beb php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb c0323c0ba49656b13995218da34ec86989f69c95 php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 1af699f0b12bbdbc11453fad2552f7a8d088f20b php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 21579f2fb823b97d858635fd8b1269d8771443a9 php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 7866b063df6741152b999f2ea4cbdf30b81ddcc9 php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 60c7d7b0ca8d5df3c66dc5b095e0f1139aa6833c php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 33efd9c45c5a0bb166520ea1e31afba17815c47c php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 9c68c4ba0e635ddeefec2e213e52be99c84af4e4 php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 2d5e3bf92720973daf8206003d67851ff13f3915 php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 150900fd7cb5369daf20dde51f59d34d1939788f php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 3c86957b3eaa67f231d87ea83e1fc754a15b8fec php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb ba7bd7d5ecc1db5633a3932796562717d1163d2a php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 102c90d641591a092fd3a8ee18c30c6051d3f764 php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb bef5c7b54b1bbe1c24e80b73eeac8b5abcd61331 php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb b67f6b70e9002051d521575388ebce2f87d10798 php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 2e32af5461a0527dbfc20daf942dd39b4e02a292 php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 6a1ac24c6d0b46aaedbd6a803781fde4f06bc384 php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb bf27d3e2aabd5a6351c82a04cb9412496b14597f php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 6ec942ad97d285c2d31264e251de8e95ff49f062 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 0c8b77e003ff21c849f052c8b248b34484653cb6 php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 3bb3a91531b31eba84ce5c0228e0ef8e9fe35c10 php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb e0582f62a522c6242490e95675636235915d7ffb php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb b8cfd17c49ac05b79476dbf8983796ed544acecd php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb eab247a3b7e1b9fd7a439a25e102df7582e594ed php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb a5df4b0df8714e4cf8e7aed107067d8ade253e0c php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 5c862b53706c9b4c5850a185c38d23abeb7655b9 php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_arm64.deb 2790a46c7f6e170d30f7df937060cf77f511eb37 libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 672e4eeac8fda73249627e77acef34cf261544ef libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 9a89132df7ca1681447fe2f7d608d8e4a440e86b php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 28013a9cd59d5c7e67859d96f58d2805d2c8623b php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 98fae96f15cc3d2d3350a18c10e41946f95a3090 php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 7934307512f11fbc869a2a89fc81b535ada25681 php7.4-cli_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 5b1cbb57a9088bfe768ac0ee7755c50e8012c3fd php7.4-common_7.4.33-1+deb11u12+tuxcare.els1_armel.deb a1d512ec272245a9486b15d62048c9bb6d9486f8 php7.4-curl_7.4.33-1+deb11u12+tuxcare.els1_armel.deb cbb4af37790de8aebd444b0b3a5a8ed98d125c34 php7.4-dba_7.4.33-1+deb11u12+tuxcare.els1_armel.deb f70109c9d1f897c93f1138f6f83f4046ca36352a php7.4-dev_7.4.33-1+deb11u12+tuxcare.els1_armel.deb b29a53614bb4af9eb5d2e018feb1ad732bed16ad php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els1_armel.deb d11faa161ca0c72440a665e9baa99902801b7de1 php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els1_armel.deb ad8792c8ce342a0b4683deb2654d8349e0b804df php7.4-gd_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 03dd6c4c28345bfc08416462ac13ac5d2027c0da php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els1_armel.deb f3495864e198d69359361ac54090825a82a8e7af php7.4-imap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 5d75a7fa634a45f97147a279aac2bd7258f39c5c php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 4058464a8e5ffa8f3d56fbeb7cf9c57139c38916 php7.4-intl_7.4.33-1+deb11u12+tuxcare.els1_armel.deb fd5565956cfc797330263b2378578b196d57cc91 php7.4-json_7.4.33-1+deb11u12+tuxcare.els1_armel.deb d8bd1651cb234010944fbf48077f6761f7419064 php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb be7c8ff4f5e09fa376be6bd47b70766b39ee11f1 php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els1_armel.deb ad339d1fccb06e9c8972353d91d4e7338a6048ea php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els1_armel.deb e06bd7cfa60f11957b8eb61f7b3220e585b59f5b php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 0d69caef52e3306d11af15e645a435a0f7557a4e php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els1_armel.deb a1f4cbc371f5468cd07670e86b8cf4ecb58bb61c php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 27a5346f0f7e3300af8250378423500c410cb99f php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els1_armel.deb c42015da8a62681afe53db04f5b8fcd5b71210ea php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els1_armel.deb f06df0168d98d67b9d7b55904ad2caa15fe8c8a0 php7.4-readline_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 363c74c3474711f89a4ee44c0475babbd14a7955 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els1_armel.deb b6c9f7b4b664f5d9100b01519a6ca165b953623a php7.4-soap_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 4ddb35e1a64931c9ac4af7f6444d8034561a2211 php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 2abdaa1d6c009d978b59f5765290bec5b581f4a2 php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els1_armel.deb 53b34dab092cfeb7dc479d39830d205cc79c101e php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els1_armel.deb c86e009b561d7a32d0d86fc5487380beac9634a7 php7.4-xml_7.4.33-1+deb11u12+tuxcare.els1_armel.deb d1595d91fbc230aa77073801209a1b045fb541cf php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els1_armel.deb da91f39cdc8ed4dbd3d67dba0acf6f81a9ee1bc7 php7.4-zip_7.4.33-1+deb11u12+tuxcare.els1_armel.deb adcb9da052c46814b891817aaa3d8aa7ed7cad4d CLSA-2026:1791935175 TuxCare License Agreement 0 * SECURITY UPDATE: Path traversal in the AD GPO provider allows writing files outside the GPO cache directory as root - debian/patches/CVE-2026-14476.patch: reject ".." components of gPCFileSysPath in ad_gpo_extract_smb_components() in src/providers/ad/ad_gpo.c and check that the resolved cache path stays inside GPO_CACHE_PATH in gpo_cache_store_file() in src/providers/ad/ad_gpo_child.c - CVE-2026-14476 * SECURITY UPDATE: Unrestricted LDAP sudo search base allows injecting sudoRole objects granting root privileges - debian/patches/CVE-2026-14474.patch: warn when ldap_sudo_search_base is not set and the whole directory tree is searched in sdap_set_config_options_with_rootdse() in src/providers/ldap/sdap.c - CVE-2026-14474 * SECURITY UPDATE: Privilege escalation via the Kerberos an2ln localauth fallback on AD/IPA clients - debian/patches/CVE-2025-11561.patch: disable the an2ln localauth plugin in the SSSD localauth plugin configuration snippet in src/util/domain_info_utils.c - CVE-2025-11561 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Path traversal in the AD GPO provider allows writing files outside the GPO cache directory as root - debian/patches/CVE-2026-14476.patch: reject ".." components of gPCFileSysPath in ad_gpo_extract_smb_components() in src/providers/ad/ad_gpo.c and check that the resolved cache path stays inside GPO_CACHE_PATH in gpo_cache_store_file() in src/providers/ad/ad_gpo_child.c - CVE-2026-14476 * SECURITY UPDATE: Unrestricted LDAP sudo search base allows injecting sudoRole objects granting root privileges - debian/patches/CVE-2026-14474.patch: warn when ldap_sudo_search_base is not set and the whole directory tree is searched in sdap_set_config_options_with_rootdse() in src/providers/ldap/sdap.c - CVE-2026-14474 * SECURITY UPDATE: Privilege escalation via the Kerberos an2ln localauth fallback on AD/IPA clients - debian/patches/CVE-2025-11561.patch: disable the an2ln localauth plugin in the SSSD localauth plugin configuration snippet in src/util/domain_info_utils.c - CVE-2025-11561

0 tuxcare-debian11-els libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 111db3cc8b4b44b5a376376e6c0a57859035efcd libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb c8e948a7c5ac6186819044b243695d7289cf34cc libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb d4414c8a9a5574ba230dfaccb444c175708cfcd7 libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb ec462343c4b1e2781aee6ec770d38c77b6e8347a libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb e47c5c63d8ff9f219d9ab2a53995807b0428c0c4 libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb b620b867b50fcee6751a3072635d55e4490d4228 libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 9cb48f9285ff85dbc446f5561db2052c076fe0e3 libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 757d02796efc0275f87aa16b484784844dcfab46 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb d4d391ec56c3af9b192ed3f228772e366a450321 libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb f75c0a7bdfd7b8761fc340563c687f34e90adac1 libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb dda6e6dbac0350f07466a8f2f064c7aa2b705f84 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 6078a2514c6556d3cfcc14677487a033af30e141 libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 17ddc36ce8111fda8f33c0139590f4381ef4f1e5 libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb a5ecc88efab2d55251a25845c2149b01760bf562 libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 88dead8b95c9f280082c4641c73ad6a13d0bc9db python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 7e7f758135f1af545a53c745e7ab71f13936cef0 python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 0a497190705f81ad3bf152e56039450fbe386f29 python3-sss_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 095d06fe3043115efe222ea170c19ce080754eb5 sssd_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 6b5c64f0c46007a496736dc2b355ecda636a01eb sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb db182e84b5605ca7e6cc74522d252d948e1d15e1 sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb b54b0c79b7125283df65816d39f675478c71af40 sssd-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 538fdf86659689afc052f5071b790f0c4a02e946 sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb f029b63218aa48b47095be466c2c60d15690db9c sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb d1cb6672ec26c265266eb451215ca8cac5d12edb sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 8c1e1157a090ff54742877139736c653ba7a0e23 sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 6c393566ee8e7f7dbae11e7f239c40a5aafed797 sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 6f7efffe2ed54a20d372b1a6370922668fab6193 sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 275695f03bc64ea50dc21c8e1889f330deabbd61 sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 33a20840ad5642761f5dc8245bd1373d365009e9 sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_amd64.deb 8a327ab598d9bb6bce8e7f74cb646a25d6abed76 libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 59325e1414f81a555b1fa0debefa1e6967e7da8b libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 39fc3c96a2b35c6766e937ec628a449f6e118979 libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 7dec3b9cd4669ed9357ce30e5e5c08f1b4123cad libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 1547e0cae82fcdbe53ebad49a35921174e537ad7 libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb b07bd6b6d44b1f683cf70f6214dcc981c0a5b1d2 libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 45753406ca8b8d1c5b6c1023d0f57a4c547124e7 libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 36de3bc2d69bcce3d909845732a8152a48ccd132 libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 691a5b86b217b38767eb278b05bc1ab1e0f21de4 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 0a5331e7c9c379c37b70fd77768e5226a8e5bacb libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 4a915e2705e2b56748f8c810dec3445ab036e222 libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 0e3c615511547e3eeade3aa4ed1bca8b90b40863 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 6c554da1e3f19b51bcbea1b767a3624e40351d56 libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 1fb4e9e7c045231eb6df897f14363bb6c4e5ae4c libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 991b0d7d0f96c1c4f3dd38d04db9f8ab93a2e2e2 libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb bff0bcebaff82ab22c2306a92dd1a925bc511e46 python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 6739803dbd588e048d034897d33aeb881754dfd5 python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 0a91e58856d056acec3c922a1e6102c0bd812236 python3-sss_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb cd2ab0bb40c3661d9fec235e42a6730d03d4cdf7 sssd_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb a3e261716ec4240ce18c0ca7743a5d6c13e412c5 sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb bcdba14dab99ba834f310ce080be9f994e2a9dea sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 804927b525cafeab93e3146f133328249bd51883 sssd-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 1ab2eb5f1f5659ffffd947b89ba8ffb75b82d70c sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 619093b94424d5d5d26a0ea6719e7efb457e5423 sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 3ccbf45e08685b678a54e22d45881763e13839fe sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 31a98ca1e6197de8e7b7f61a74833489602b785f sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 4fc42ae7d5e52f822bad76fd6ada47f8bf813e46 sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 65528d293f3b69cc2c4bdffed26fcef16c4f6368 sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 3cb711c8d9397c0decb840a6c33b8d984152df6b sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb 85f97c5a8d0e25efd6d99a8ebd51651749df6750 sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_arm64.deb b9b0495b17a19acb5bb36bcfe07d45109081cd39 libipa-hbac-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb a5690b33a98ee3ce6edba135a6fb19755eb0f712 libipa-hbac0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 6515118f8bc72d25850908196caac8af59b67df1 libnss-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 7be31796b53f7ad09a10d392dae716bc1af23bb2 libpam-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb ff84e167612fe5ecc23721dde9243976ea2f70c7 libsss-certmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 7f40c45d51fa87e88d48043e6671dcf60befa0b3 libsss-certmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb f8a12df19ef5f8b20222deca5c8e4f357eb011cb libsss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 9529376a1039f16a5a8dae67164ec4dab64ea79d libsss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 0a171a791070159ee75733dba5cad97619a7ffa4 libsss-nss-idmap-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 1c9ef73fab8fc73e421dea5f49cc79096856b3c4 libsss-nss-idmap0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb f26a2c288a07ad6a9b06d0f3c151c997ded95a6c libsss-simpleifp-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb afc0e07c0944b816512efc3f037968285c5164f9 libsss-simpleifp0_2.4.1-2+deb11u1+tuxcare.els3_armel.deb d5317af64f7867a66c80bbc74058540744819881 libsss-sudo_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 04d90c3493ea738f058b47d9dae11241bb4eed30 libwbclient-sssd_2.4.1-2+deb11u1+tuxcare.els3_armel.deb dd610aa4d5b0de75d38bd7381840d934875c24e4 libwbclient-sssd-dev_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 94f29c8a24f6f6bbf06988610020f7ae33747529 python3-libipa-hbac_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 0588a32da7c0d416bdeab42a026f4a99650905fd python3-libsss-nss-idmap_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 5c615ea63efc6ab659048061b133a8a163f3c2d9 python3-sss_2.4.1-2+deb11u1+tuxcare.els3_armel.deb a494c7713bc1bce529c545afcd36d34e399f2146 sssd_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 00e23e69672a914cb15d21cf2ef54c1514138e80 sssd-ad_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 6f4fd5e96512c16886b5774d89de356de3b346e3 sssd-ad-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 76bdf50bf231279be197026149a0650b2b626630 sssd-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb ad41ed84c9352a79a5ea54b4db42ad46c8e114a8 sssd-dbus_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 821acc6af03b3ce1968e62f217a0c5cd2638011c sssd-ipa_2.4.1-2+deb11u1+tuxcare.els3_armel.deb e742115a4916cb2731bb48a4481caac3929215e4 sssd-kcm_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 7edb476168d9a67d58265c6a199867683a899019 sssd-krb5_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 6ec53fe905e5dd53247f6cd81d77c32275e018f3 sssd-krb5-common_2.4.1-2+deb11u1+tuxcare.els3_armel.deb f7b1ad2068ffe8833413d99684371da8c8466136 sssd-ldap_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 3a61cdecd3e2c64bc32877cc0515d0bf66d20590 sssd-proxy_2.4.1-2+deb11u1+tuxcare.els3_armel.deb 8e20fe78f86a040fa98b567c42712037af481b30 sssd-tools_2.4.1-2+deb11u1+tuxcare.els3_armel.deb a3d36ed83d4b42004eca80fa65372c1bb9da11fc CLSA-2026:1791964610 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-memory in NSE packet option parsing - debian/patches/CVE-2026-72712.patch: stop option parsing in Packet:parse_options() when a packet option reports a zero length - CVE-2026-72712 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-memory in NSE packet option parsing - debian/patches/CVE-2026-72712.patch: stop option parsing in Packet:parse_options() when a packet option reports a zero length - CVE-2026-72712

0 tuxcare-debian11-els ncat_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_amd64.deb f9622d308bb6a63d89bda542c37cbf53c27cbeb1 ndiff_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_all.deb bcec03b35839778404557550d1df65cc9cb90d3a nmap_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_amd64.deb d26d7576121460c9e5b9debcbb8dab22fdc6f681 nmap-common_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_all.deb c4132e1d33612758ee04f77b2842c4c07332ad55 ncat_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_arm64.deb 92003823228443f4325fb20a6b57278a36aa32d7 nmap_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_arm64.deb a3a42e845706e007467457617e29523be4c08223 ncat_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_armel.deb 2db5b7e4d9f066871dca5a3ff67493db632a0674 nmap_7.91+dfsg1+really7.80+dfsg1-2+tuxcare.els1_armel.deb cd907dce4cce60a0d1838d220ba4af341c129a6f CLSA-2026:1791969205 TuxCare License Agreement 0 * SECURITY UPDATE: use-after-free in the SNI servername callback when the callback switches the connection to another SSLContext - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the connection with SSL_get_app_data() and hold strong references to it and to the Python callback for the duration of _servername_callback() in Modules/_ssl.c, instead of the borrowed pointer registered with SSL_CTX_set_tlsext_servername_arg(), which the callback itself releases when it assigns SSLSocket.context; stop registering that argument in set_servername_callback() and unregister the servername callback in context_dealloc() so an SSL_CTX that outlives its SSLContext as a connection's session_ctx leaves no Python callback behind - CVE-2026-19445 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: use-after-free in the SNI servername callback when the callback switches the connection to another SSLContext - debian/patches/CVE-2026-19445.patch: look the SSLContext up from the connection with SSL_get_app_data() and hold strong references to it and to the Python callback for the duration of _servername_callback() in Modules/_ssl.c, instead of the borrowed pointer registered with SSL_CTX_set_tlsext_servername_arg(), which the callback itself releases when it assigns SSLSocket.context; stop registering that argument in set_servername_callback() and unregister the servername callback in context_dealloc() so an SSL_CTX that outlives its SSLContext as a connection's session_ctx leaves no Python callback behind - CVE-2026-19445

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els6_all.deb 0785ef5fcf2e9b9b6c0d4d5241a4e524c17fdbd7 libpython2.7_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb ea3dbecfe5cb4909b1e82092b6d598e2dc044f9c libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb e242d6f49df8e4e2e82330df14827529846aba4d libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb 8d0597f0c83ddb1136c6478f2d58826baa672a2c libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb b3dc58dc7be5a7b24a1d5c557d4aae844de675ff libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els6_all.deb 48bcd2424d91c1233488825483c4bd427b5171f9 python2.7_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb 726c0accd5e8b7bc2485eb6068697038726b2e59 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb c49057ac9b47ee978a6fcf13f1d62e0da0cfa88a python2.7-doc_2.7.18-8+deb11u1+tuxcare.els6_all.deb b224720f12128ad0e8338ef3a323524ed65ac461 python2.7-examples_2.7.18-8+deb11u1+tuxcare.els6_all.deb f59503e372861146158e0795967c0d550e922f6b python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_amd64.deb 9545e8c9eb886bcb1a8f12b873e1ef77798bfd5e libpython2.7_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb b9d7db597a0c3cc700dabb4ee9a4285f0e5376ec libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb 7045ce3deb7880414c77a49f4f6352d3afbb4c8e libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb 7cea59548a2a2f186898b5e329476f0bae453867 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb 79e729c6232586a4932bec906ef42af9fb4c3966 python2.7_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb da0d079d6b75c7c656c5f8f78921abfe0770fe88 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb 96eafb77059a7b68fc447d9f0ceda23dee59d59e python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_arm64.deb 835056e1f85083943d6be7257d58bd7524fddd6c libpython2.7_2.7.18-8+deb11u1+tuxcare.els6_armel.deb f549b4ab497965398fb83adb6758351f1d1f16e2 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_armel.deb 24eac0ac22c03deaebac3d655cdc00421c2c41d3 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_armel.deb 7c876214247a18724db0a84f3d22fb53e2bd7e54 libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els6_armel.deb 97d3fd04fbcc7c03f104a98a7b8f366278f8f1dc python2.7_2.7.18-8+deb11u1+tuxcare.els6_armel.deb 3c759bd92b588ecb999a4eb9033ae668a4b0a78b python2.7-dev_2.7.18-8+deb11u1+tuxcare.els6_armel.deb c17ff5bffe2802177a4e37041063a81319d812cc python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els6_armel.deb 67cbd465c43f87745e847e605c4b00da34520fdf CLSA-2026:1791982489 TuxCare License Agreement 0 * SECURITY UPDATE: integer overflow in the virNodeGetFreePages RPC handler - debian/patches/CVE-2026-18917.patch: check for multiplication overflow in remoteDispatchNodeGetFreePages() - CVE-2026-18917 * SECURITY UPDATE: virFileChownFiles() follows symlinks - debian/patches/CVE-2026-63622.patch: use lstat() and lchown() in virFileChownFiles() so symlinks are not followed - CVE-2026-63622 * debian/patches/tests-virnetsockettest-skip-ssh-as-root.patch: skip virnetsockettest SSH cases when the test suite runs as root Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: integer overflow in the virNodeGetFreePages RPC handler - debian/patches/CVE-2026-18917.patch: check for multiplication overflow in remoteDispatchNodeGetFreePages() - CVE-2026-18917 * SECURITY UPDATE: virFileChownFiles() follows symlinks - debian/patches/CVE-2026-63622.patch: use lstat() and lchown() in virFileChownFiles() so symlinks are not followed - CVE-2026-63622 * debian/patches/tests-virnetsockettest-skip-ssh-as-root.patch: skip virnetsockettest SSH cases when the test suite runs as root

0 tuxcare-debian11-els libnss-libvirt_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 6cbbcdaf8bc900a589a6cf8ee3fb716218f00fcb libvirt-clients_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 951bcfbe0929d0368fb0600ab7824384288fda44 libvirt-daemon_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb d048165c40a6faf3454fb0fd6372f577f6f511e8 libvirt-daemon-config-network_7.0.0-3+deb11u4+tuxcare.els1_all.deb 4d5e82a45cad683a0a9078af770df885168f66d1 libvirt-daemon-config-nwfilter_7.0.0-3+deb11u4+tuxcare.els1_all.deb 63ba309346f8583851bfbe1cf197c56a76668710 libvirt-daemon-driver-lxc_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 8df9df236e244fa014d4bf5c45deac1825961748 libvirt-daemon-driver-qemu_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb ff2b3515791fb15d2f29869ff7c12e730c6d40e9 libvirt-daemon-driver-storage-gluster_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 25b31c7c741880ffca5326acd79d4882737212be libvirt-daemon-driver-storage-iscsi-direct_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 6e9d82b1d3e3fb5a37a23b0a1cd9e3a6edd4ba80 libvirt-daemon-driver-storage-rbd_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb f020341e9750846b4e071087f7f36932f8a65d6f libvirt-daemon-driver-storage-zfs_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 51959f2dd75c322f7df0164db6767bf75fb27c9d libvirt-daemon-driver-vbox_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 05e8bc9d36b0100c71d124d0a6950cebd9765e97 libvirt-daemon-driver-xen_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 0a3fd79a549c7417ef1cf059fb9f142da868b944 libvirt-daemon-system_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb f4b8cbf4943bb62ec2c67e5194b4071a9f26571b libvirt-daemon-system-systemd_7.0.0-3+deb11u4+tuxcare.els1_all.deb f1dd5634e63dc3a7242aa824e198f78cb8d956ad libvirt-daemon-system-sysv_7.0.0-3+deb11u4+tuxcare.els1_all.deb 5b02e78d71fe3aba5d10c0ee3b4e13e0c8e57ab4 libvirt-dev_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 0b31577174eb117c7031315b931e4c555001adda libvirt-doc_7.0.0-3+deb11u4+tuxcare.els1_all.deb bca7ffc82ba3127a1924991f3abb53533f9c239f libvirt-login-shell_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb bc94d25d40322f9e4b697483e5c25f4198bb101d libvirt-sanlock_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 9d8483dd45385f6ef8f24635d0ba5089d9544f1b libvirt-wireshark_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb ebe3107bbbf61e9eba986eee700b4763690e4edc libvirt0_7.0.0-3+deb11u4+tuxcare.els1_amd64.deb 76afe6b323ef557c789c807aa1a24ee8c4e1d486 libnss-libvirt_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 0562b0f62c9f3bf3f06be862f1a97ca0bd897221 libvirt-clients_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 9b14359b715535aaaff13fe4b3f642d271e0a86e libvirt-daemon_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb b9c636cd0762eaf8c2affd7fb9a42cde1018e2b9 libvirt-daemon-driver-lxc_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb aa082959c69efaf2dd0a871bac133f7fefaf45a6 libvirt-daemon-driver-qemu_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 02d1c7df2ae176ef910ba21cbfd5855b880bfda2 libvirt-daemon-driver-storage-gluster_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 26963c882c0ec10426da3379328122a263669f6c libvirt-daemon-driver-storage-iscsi-direct_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb c9415fed9c9866992cd35e1ce5bc610c57495343 libvirt-daemon-driver-storage-rbd_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb a6b5fb751221560e0a8b261bf7c1d96048b14c7c libvirt-daemon-driver-storage-zfs_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 76b7b8ee74bb4e4d926dec124f4cd46f101095ee libvirt-daemon-driver-xen_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb d7eb42fc9ac97a807154b8b868bf341de49bbb47 libvirt-daemon-system_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb ca2de1229d6dd5351d4682bcee19df4c3ad08588 libvirt-dev_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 6d03eedfb769a8d0aadb3663b2c3f84cc4f13ef2 libvirt-login-shell_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb fa0ecc26434bbfc333315e3e51648a84b1b631f4 libvirt-sanlock_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 0a9bad80426432236a528c1d662d80edc933d177 libvirt-wireshark_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb a304a882716acbc7c43b29801da8bd0a2c1b3852 libvirt0_7.0.0-3+deb11u4+tuxcare.els1_arm64.deb 53f1341c3ed3097d6e8ebcc1ddb1fa763fda9cfd libnss-libvirt_7.0.0-3+deb11u4+tuxcare.els1_armel.deb e2cfb25fba7514e268aa9124dc4352f6fecb8145 libvirt-clients_7.0.0-3+deb11u4+tuxcare.els1_armel.deb c7fd13fa106e0b0979bd99f7af173262f7dfcaac libvirt-daemon_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 998eb49abbd1596a89ce7ac47098c2714ebb9bfd libvirt-daemon-driver-lxc_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 392f0e5dcf61458d417351dba892196bb39eebdc libvirt-daemon-driver-qemu_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 16498dba4cb9da559d425bc762b054fe14790e7b libvirt-daemon-driver-storage-gluster_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 7854ff74dc824180832525c81bdb81f087d3dd3c libvirt-daemon-driver-storage-iscsi-direct_7.0.0-3+deb11u4+tuxcare.els1_armel.deb cd007dd6f6ed6fa51256f3480def5e3c2094c688 libvirt-daemon-driver-storage-rbd_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 091a4bb98d629a50b73ab29172968452869e5459 libvirt-daemon-driver-storage-zfs_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 7c8d53cf20c04771552dc111eef5b107bbafd459 libvirt-daemon-system_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 77ec7e568795e31fc67bf152a442b20e2cd12582 libvirt-dev_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 6d20523453d35c5919d6d40cd4fc1f162fed216c libvirt-login-shell_7.0.0-3+deb11u4+tuxcare.els1_armel.deb fe67eae7b42dd2d8f3f801379a9682ed82d81432 libvirt-sanlock_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 5b147ad49448168dc0d3fbd795508e12996e4cb6 libvirt-wireshark_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 31483c1c95542b55d6c3df19d4b91e015e7259ba libvirt0_7.0.0-3+deb11u4+tuxcare.els1_armel.deb 545ef1fa0f7c715fa914c356b0e618cd0bbd0a19 CLSA-2026:1792049053 TuxCare License Agreement 0 * SECURITY UPDATE: an in-flight Send-Document on any connection suppressed the submission timeout of every pending job. - debian/patches/CVE-2026-107885.patch: give Create-Job jobs an absolute MultipleOperationTimeout deadline in scheduler/ipp.c and only defer the timeout in cupsdCheckJobs() until it passes. - CVE-2026-107885 * SECURITY UPDATE: NULL dereference on repeated IPP group tags in job-creation requests. - debian/patches/CVE-2026-107890.patch: drop unnamed group-separator attributes in add_job() and add_job_subscriptions() in scheduler/ipp.c. - CVE-2026-107890 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: an in-flight Send-Document on any connection suppressed the submission timeout of every pending job. - debian/patches/CVE-2026-107885.patch: give Create-Job jobs an absolute MultipleOperationTimeout deadline in scheduler/ipp.c and only defer the timeout in cupsdCheckJobs() until it passes. - CVE-2026-107885 * SECURITY UPDATE: NULL dereference on repeated IPP group tags in job-creation requests. - debian/patches/CVE-2026-107890.patch: drop unnamed group-separator attributes in add_job() and add_job_subscriptions() in scheduler/ipp.c. - CVE-2026-107890

0 tuxcare-debian11-els cups_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb f4f0dca31d1e7b97a61c2fea834266ee2f73e230 cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb 7b060ecd9308123d2c4a12ae1c3ab4b06cf45907 cups-client_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb 1b28e1bc9a8178b98adc328ea199f3128495fbb9 cups-common_2.3.3op2-3+deb11u10+tuxcare.els2_all.deb bf6c3891c2b58185aa1e2bba956bc839f1e6ad3b cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb a20881c80f33894d7df447a424c64975e408cadf cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb 8c7526e3269944491075b9a5044cb3644078afac cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb 1c3ac085e0d496157c0a826991a0724468104ae4 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb ec8a09e0d0c2e17f2d5cde77bcd043980d02167d cups-server-common_2.3.3op2-3+deb11u10+tuxcare.els2_all.deb a1bd13b9fa113a7fafacaedad72fd0c4c3f9364e libcups2_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb 639ace88a4b29c308625e81c262607547995bf8c libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb a149ed73ec98ddf51451cdf9f3e8f66de80c3714 libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb dadbb0624d368ab61367655ad2e767c18921e4fe libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_amd64.deb ff534f53879f75edbd03724c48068250a1450a37 cups_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 0003cbe5f73093912ccb866a9310bc3dca6cf177 cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb b3af963ac2fc0587cff4984e1564f65277dd1e99 cups-client_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb b21bf816c1882ef569ad1b9ec89086a51c31acf0 cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb a98c08179f50a6cce1425201c205d76d443db4b1 cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 5c5a55dc6c73e1d22ffdfde737b06baf2cda723f cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 7f396197df45be0fa9faa6caee04ccb56fb5a8e3 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 4364bff6d80410397ad00f38c964dbdc2f21f334 libcups2_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 78ee18a30c8c1c26ff29cabf77ab6ff23dbfdff1 libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 02c8f05419ade22a5a6c04c98b265aa8a35641c9 libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 937556244787e51d7bd8150b2615f4c0fb6fc230 libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_arm64.deb 819d6b518583f301c946f575d260dd53046ba039 cups_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb ac86f6e92d5a44b28a52cf56135fc9ca5351ded8 cups-bsd_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb 39cb1b927d882b72314e2fc4e461c8b23d003828 cups-client_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb 9db46cc89f0eb8bce48dd0fe7b6ebbe9bf59a483 cups-core-drivers_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb a50741ef3ac567756312664647b90635509936a0 cups-daemon_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb d51275c353305c2e0b228675e19724dc2710fec0 cups-ipp-utils_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb 7321b168c8c87cebae2fed81016c64feb0efaff1 cups-ppdc_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb 12ae43a84cb5ada5e2192325acda2d8ab35acc07 libcups2_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb 76651dbcdc6eac752ba7c27de8cd1e89dc8786b8 libcups2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb a3f4b987e6eac68703de610f92f6030afc830daa libcupsimage2_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb a3edcddfefd3b00d09188a1c3fee82dda1ee76ec libcupsimage2-dev_2.3.3op2-3+deb11u10+tuxcare.els2_armel.deb b7aadfe225e5831bb9886c2c45557b7103f5f803 CLSA-2026:1792155767 TuxCare License Agreement 0 * SECURITY UPDATE: Hostname verification bypass in SSLContext.wrap_bio() - debian/patches/CVE-2026-19553.patch: validate the server_side, server_hostname and session arguments of SSLContext.wrap_bio() like wrap_socket() does, and emit a DeprecationWarning when check_hostname is enabled but no server_hostname is given, instead of silently skipping certificate hostname verification (backport of the upstream 3.10 fix) - CVE-2026-19553 * debian/rules: disable PGO on armel; its profile test run exceeds the build time limit Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Hostname verification bypass in SSLContext.wrap_bio() - debian/patches/CVE-2026-19553.patch: validate the server_side, server_hostname and session arguments of SSLContext.wrap_bio() like wrap_socket() does, and emit a DeprecationWarning when check_hostname is enabled but no server_hostname is given, instead of silently skipping certificate hostname verification (backport of the upstream 3.10 fix) - CVE-2026-19553 * debian/rules: disable PGO on armel; its profile test run exceeds the build time limit

0 tuxcare-debian11-els idle-python3.9_3.9.2-1+deb11u7+tuxcare.els1_all.deb 4de4d64f11186cf0eb85a532883bf3c20f2a16ad libpython3.9_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 0b7fc6c8eac153285cbb3d994c70918e99ca0485 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb cba2a3f4e79ea4f1ff1026033017e6c0d04b328a libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 01044c383fd0ac5210f629562f50224c73ee8ccf libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb ae4d0cd4ce087dc375fd575d5c5f65f000432d23 libpython3.9-testsuite_3.9.2-1+deb11u7+tuxcare.els1_all.deb 7357e85e5927675ab47be361ec4baaa8199ece72 python3.9_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 5bd29fb78cb541d1205d756b7a0cf668d17f0fc6 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 67d00e0dfaea90709a3b32e45ae5d632b3190cc4 python3.9-doc_3.9.2-1+deb11u7+tuxcare.els1_all.deb eeaeaf6bd9c49c889282aa014492376364858f9b python3.9-examples_3.9.2-1+deb11u7+tuxcare.els1_all.deb 5943c05ea7a62986391d727f8a550818c34390b4 python3.9-full_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 486af1e2f469505bf5a7ec110c71dc7bef891819 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb 06c0d20a9b4017f85a8732ad248a6cb67aae4bbe python3.9-venv_3.9.2-1+deb11u7+tuxcare.els1_amd64.deb c72c3e1220bb9c1f4893f9e5ef2dbd1db2f3b89f libpython3.9_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb a4929d6abceeb14d1ea314d49c5031ecb40a1db0 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb 4115f804ecf800c08930878ceceecf48ce49531f libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb e687c041839b3e94db2156bb48b0b90f47c809fa libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb 59b49ff9483164d707d72bfdeffbfc5de64e4bdc python3.9_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb f43a5182ae49e2324dc24ba4a9e2f81af2c8a401 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb b7cf5a9e9f6bfe2acdd2c6ef1e721bd1ef9796be python3.9-full_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb 8545f5241c2904db8de51219967b8a7895413893 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb 844a74a4f1ee317ff62583c4708764ea708254d5 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els1_arm64.deb 0053029ab5992e5c6b9e0cacd78a72e552a518ff libpython3.9_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 43fb3397f702bb934a27682b9ed269979d95230f libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 7afcac1b8874ffbaf0a06bd754b654519e752312 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 79f24dd36ee9640ad38e2550d8622702507c4204 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els1_armel.deb d6f11b2ff599b846c1e281eb7ada4c39f3601f9f python3.9_3.9.2-1+deb11u7+tuxcare.els1_armel.deb ee79aec80460aea8a17976f4db90590aadce60ba python3.9-dev_3.9.2-1+deb11u7+tuxcare.els1_armel.deb e23f956e1f9176240e8d4196c3b9bd357645cbdb python3.9-full_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 864c721fdd49962446c317939b0abed30569d38a python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 9d998e40dfc34788fbf9ed1898bd2030d43f2bf2 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els1_armel.deb 2ad62b65b95663df421ce4f07620e2f82362da51 CLSA-2026:1792159189 TuxCare License Agreement 0 * SECURITY UPDATE: GSSAPI authentication state persisted across attempts - debian/patches/CVE-2026-106555.patch: reset the global GSSAPI client state at the start of each authentication request and GSSAPI context setup, except for gssapi-keyex and post-authentication re-keying. - CVE-2026-106555 * SECURITY UPDATE: GSSAPI credentials stored after failed authentication - debian/patches/CVE-2026-106553.patch: only store delegated GSSAPI credentials when the GSSAPI client was authorized. - CVE-2026-106553 * SECURITY UPDATE: injection via command-line username - debian/patches/CVE-2026-106583.patch: disallow '$' and '\' in a command-line supplied username. - CVE-2026-106583 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: GSSAPI authentication state persisted across attempts - debian/patches/CVE-2026-106555.patch: reset the global GSSAPI client state at the start of each authentication request and GSSAPI context setup, except for gssapi-keyex and post-authentication re-keying. - CVE-2026-106555 * SECURITY UPDATE: GSSAPI credentials stored after failed authentication - debian/patches/CVE-2026-106553.patch: only store delegated GSSAPI credentials when the GSSAPI client was authorized. - CVE-2026-106553 * SECURITY UPDATE: injection via command-line username - debian/patches/CVE-2026-106583.patch: disallow '$' and '\' in a command-line supplied username. - CVE-2026-106583

0 tuxcare-debian11-els openssh-client_8.4p1-5+deb11u7+tuxcare.els4_amd64.deb 19b0d644b7f0f9027a0643d1b2e031896f290e3c openssh-server_8.4p1-5+deb11u7+tuxcare.els4_amd64.deb 052a79db650a6db1adb6904a4d5f5e7c0e46c360 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els4_amd64.deb ce4844f00ecb5b5346e33b3d0d0678cf7e48798f openssh-tests_8.4p1-5+deb11u7+tuxcare.els4_amd64.deb 7dc9d441c4ac99d25fcc7c8a5d8ddddc71417b1d ssh_8.4p1-5+deb11u7+tuxcare.els4_all.deb b60c7243b235052ceb71798a80dbda2cab6527f7 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els4_amd64.deb e8ce0b7cba0da82d1a23ad3975f97f13f7a516a3 openssh-client_8.4p1-5+deb11u7+tuxcare.els4_arm64.deb ea765a86285e633c721239db05e2aade4442f181 openssh-server_8.4p1-5+deb11u7+tuxcare.els4_arm64.deb 9526edcff477933ec5dbc25e8e6f198d4810e5a4 openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els4_arm64.deb 6847012b405a79061b772300121c0ac126975936 openssh-tests_8.4p1-5+deb11u7+tuxcare.els4_arm64.deb 331e3bb7243ada04da3ca2673c43faddd18b48a3 ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els4_arm64.deb 0d0d485649198034792b31268f8b2084b8bd4fc2 openssh-client_8.4p1-5+deb11u7+tuxcare.els4_armel.deb 4079da37b2fd11b55dc3e215980af96f629d0b85 openssh-server_8.4p1-5+deb11u7+tuxcare.els4_armel.deb 67304d8887e8ccb5436a0eb03c507d3cb649e99f openssh-sftp-server_8.4p1-5+deb11u7+tuxcare.els4_armel.deb 67e8e8fd11a8fd64bb6bc5799b69470a694e1797 openssh-tests_8.4p1-5+deb11u7+tuxcare.els4_armel.deb fb4568f6c988a02c1333079832c516b765f34b1c ssh-askpass-gnome_8.4p1-5+deb11u7+tuxcare.els4_armel.deb c1de065ab37148226d1f7f652d03de739fe18025 CLSA-2026:1788803338 TuxCare License Agreement 0 * Update to upstream stable Linux 5.10.269 (from 5.10.262). * Bump kernel ABI to 48: ship the ELS kernel as 5.10.0-48-*, distinct from the prior 5.10.0-47. * CVE-2024-40973 - media: mtk-vcodec: potential null pointer deference in SCP {CVE-2024-40973} * CVE-2024-46754 - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754} * CVE-2024-50125 - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125} * CVE-2024-58094 - jfs: add check read-only before truncation in jfs_truncate_nolock() {CVE-2024-58094} * CVE-2024-58095 - jfs: add check read-only before txBeginAnon() call {CVE-2024-58095} * CVE-2024-58240 - tls: separate no-async decryption request handling from async {CVE-2024-58240} * CVE-2025-23160 - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization {CVE-2025-23160} * CVE-2025-38524 - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524} * CVE-2025-40054 - f2fs: fix UAF issue in f2fs_merge_page_bio() {CVE-2025-40054} * CVE-2025-40102 - KVM: arm64: Prevent access to vCPU events before init {CVE-2025-40102} * CVE-2025-68794 - iomap: adjust read range correctly for non-block-aligned positions {CVE-2025-68794} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2026-31650 - mmc: vub300: fix use-after-free on disconnect {CVE-2026-31650} * CVE-2026-43491 - net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491} * CVE-2026-45839 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() {CVE-2026-45839} * CVE-2026-46003 - net: qrtr: ns: Raise node count limit to 512 {CVE-2026-46003} * CVE-2026-46026 - net: qrtr: ns: Raise lookup limit to 128 {CVE-2026-46026} * CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} * CVE-2026-53090 - bpf: Fix ld_{abs,ind} failure path analysis in subprogs {CVE-2026-53090} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-64048 - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot {CVE-2026-64048} * CVE-2026-64192 - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized {CVE-2026-64192} * CVE-2026-64269 - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg {CVE-2026-64269} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64280 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280} * CVE-2026-64336 - USB: serial: keyspan_pda: fix information leak {CVE-2026-64336} * CVE-2026-64371 - proc: Fix broken error paths for namespace links {CVE-2026-64371} * CVE-2026-64427 - HID: logitech-dj: Fix maxfield check in DJ short report validation {CVE-2026-64427} * CVE-2026-64434 - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref {CVE-2026-64434} - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev {CVE-2026-64434} * CVE-2026-64535 - nvmet-tcp: Fix potential UAF when ddgst mismatch {CVE-2026-64535} * CVE-2026-64543 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} * CVE-2026-64562 - KVM: nVMX: Hide shadow VMCS right after VMCLEAR {CVE-2026-64562} * CVE-2026-64563 - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} * CVE-2026-64565 - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() {CVE-2026-64565} - Input: ims-pcu - fix logic error in packet reset {CVE-2026-64565} * CVE-2026-64567 - btrfs: reject free space cache with more entries than pages {CVE-2026-64567} * CVE-2026-64569 - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n {CVE-2026-64569} * CVE-2026-64571 - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() {CVE-2026-64571} * CVE-2026-64572 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} * CVE-2026-64579 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} * CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() {CVE-2026-64581} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-64584 - usb: gadget: f_midi: cancel pending IN work before freeing the midi object {CVE-2026-64584} * CVE-2026-64586 - wifi: brcmfmac: drain bus_reset work on device removal {CVE-2026-64586} * CVE-2026-64590 - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning {CVE-2026-64590} - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() {CVE-2026-64590} * CVE-2026-68082 - libceph: fix two unsafe bare decodes in decode_lockers() {CVE-2026-68082} * CVE-2026-68096 - audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096} * CVE-2026-68104 - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd {CVE-2026-68104} * CVE-2026-68106 - drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106} * CVE-2026-68111 - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111} * CVE-2026-68115 - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115} * CVE-2026-68117 - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() {CVE-2026-68117} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-68123 - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} * CVE-2026-68125 - mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125} * CVE-2026-68127 - ila: reload IPv6 header after pskb_may_pull in checksum adjust {CVE-2026-68127} * CVE-2026-68131 - rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131} * CVE-2026-68132 - super: fix emergency thaw deadlock on frozen block devices {CVE-2026-68132} * CVE-2026-68135 - net: hip04: fix RX buffer leak on build_skb failure {CVE-2026-68135} * CVE-2026-68136 - net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136} * CVE-2026-68137 - net/x25: fix use-after-free in x25_kill_by_neigh() {CVE-2026-68137} * CVE-2026-68138 - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} * CVE-2026-68140 - net/iucv: fix use-after-free of a severed iucv_path {CVE-2026-68140} * CVE-2026-68141 - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() {CVE-2026-68141} * CVE-2026-68142 - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-68146 - ftrace: Add global mutex to serialize trace_parser access {CVE-2026-68146} * CVE-2026-68151 - binfmt_elf_fdpic: only honour the first PT_INTERP {CVE-2026-68151} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-68154 - libceph: reject zero bucket types in crush_decode {CVE-2026-68154} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2026-68157 - libceph: guard missing CRUSH type name lookup {CVE-2026-68157} * CVE-2026-68158 - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} * CVE-2026-68159 - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-68162 - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} * CVE-2026-68175 - tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175} * CVE-2026-68176 - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} * CVE-2026-68180 - intel_th: fix MSC output device reference leak {CVE-2026-68180} * CVE-2026-68182 - comedi: comedi_parport: deal with premature interrupt {CVE-2026-68182} * CVE-2026-68183 - firmware: stratix10-svc: fix memory leaks and list corruption bugs {CVE-2026-68183} * CVE-2026-68184 - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184} * CVE-2026-68186 - binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186} * CVE-2026-68187 - exec: fix unsigned loop counter wrap in transfer_args_to_stack() {CVE-2026-68187} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-68192 - wifi: brcmfmac: make release_scratchbuffers idempotent {CVE-2026-68192} * CVE-2026-68195 - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses {CVE-2026-68195} * CVE-2026-68196 - wifi: wilc1000: validate assoc response length before subtracting header {CVE-2026-68196} * CVE-2026-68197 - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-68204 - media: vivid: check for vb2_is_busy() when toggling caps {CVE-2026-68204} * CVE-2026-68205 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() {CVE-2026-68205} * CVE-2026-68209 - media: sun4i-csi: Return queued buffers on start_streaming() failure {CVE-2026-68209} * CVE-2026-68212 - media: saa7134: Fix a possible memory leak in saa7134_video_init1 {CVE-2026-68212} * CVE-2026-68213 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure {CVE-2026-68213} * CVE-2026-68214 - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} * CVE-2026-68215 - media: radio-si476x: Unregister v4l2_device on probe failure {CVE-2026-68215} * CVE-2026-68216 - media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216} * CVE-2026-68217 - media: pwc: Drain fill_buf on start_streaming() failure {CVE-2026-68217} * CVE-2026-68218 - media: pci: dm1105: Free allocated workqueue {CVE-2026-68218} * CVE-2026-68222 - media: msi2500: Return queued buffers on start_streaming() failure {CVE-2026-68222} * CVE-2026-68223 - media: meson: vdec: Fix memory leak in error path of vdec_open {CVE-2026-68223} * CVE-2026-68226 - media: cx23885: add ioremap return check and cleanup {CVE-2026-68226} * CVE-2026-68227 - media: cx231xx: fix devres lifetime {CVE-2026-68227} * CVE-2026-68229 - media: cedrus: skip invalid H.264 reference list entries {CVE-2026-68229} * CVE-2026-68231 - media: airspy: Return queued buffers on start_streaming() failure {CVE-2026-68231} * CVE-2026-68234 - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234} * CVE-2026-68249 - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() {CVE-2026-68249} * CVE-2026-68250 - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() {CVE-2026-68250} * CVE-2026-68255 - drm/virtio: bound EDID block reads to the response buffer {CVE-2026-68255} * CVE-2026-68277 - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers {CVE-2026-68277} * CVE-2026-68278 - drm/dp/mst: fix buffer overflows in sideband chunk accumulation {CVE-2026-68278} * CVE-2026-68279 - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers {CVE-2026-68279} * CVE-2026-68284 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() {CVE-2026-68284} * CVE-2026-68294 - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} * CVE-2026-68297 - tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297} * CVE-2026-68299 - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299} * CVE-2026-68300 - sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300} * CVE-2026-68304 - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304} * CVE-2026-68313 - tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313} * CVE-2026-68315 - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-68322 - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled {CVE-2026-68322} * CVE-2026-68325 - iommu/amd: Bound the early ACPI HID map {CVE-2026-68325} * CVE-2026-68326 - wifi: mwifiex: bound uAP association event IEs to the event buffer {CVE-2026-68326} * CVE-2026-68327 - wan: wanxl: Only reset hardware after BAR mapping {CVE-2026-68327} * CVE-2026-68328 - nfp: Check resource mutex allocation {CVE-2026-68328} * CVE-2026-68335 - rds: drop incoming messages that cross network namespace boundaries {CVE-2026-68335} * CVE-2026-68338 - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} * CVE-2026-68344 - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect {CVE-2026-68344} * CVE-2026-68349 - wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349} * CVE-2026-68350 - wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350} * CVE-2026-68351 - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351} * CVE-2026-68352 - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event {CVE-2026-68352} * CVE-2026-68353 - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler {CVE-2026-68353} * CVE-2026-68354 - firewire: net: Fix fragmented datagram reassembly {CVE-2026-68354} * CVE-2026-68355 - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355} * CVE-2026-68357 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357} * CVE-2026-68360 - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop {CVE-2026-68360} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-68365 - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} * CVE-2026-68366 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer {CVE-2026-68366} * CVE-2026-68367 - usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367} * CVE-2026-68368 - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() {CVE-2026-68368} * CVE-2026-68369 - usb: gadget: printer: fix infinite loop in printer_read() {CVE-2026-68369} * CVE-2026-68370 - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback {CVE-2026-68370} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-68377 - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} * CVE-2026-68388 - smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388} * CVE-2026-68395 - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered {CVE-2026-68395} * CVE-2026-68397 - net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397} * CVE-2026-68402 - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} * CVE-2026-68403 - wifi: brcmfmac: initialize SDIO data work before cleanup {CVE-2026-68403} * CVE-2026-68405 - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405} * CVE-2026-68406 - wifi: cfg80211: validate PMSR FTM preamble range {CVE-2026-68406} * CVE-2026-68410 - wifi: libertas: fix memory leak in helper_firmware_cb() {CVE-2026-68410} * CVE-2026-68411 - wifi: mac80211_hwsim: clamp virtio RX length before skb_put {CVE-2026-68411} * CVE-2026-68413 - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413} * CVE-2026-68425 - IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425} * CVE-2026-68428 - KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428} * CVE-2026-68430 - drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430} * CVE-2026-68432 - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} * CVE-2026-68433 - libceph: bound get_version reply decode to front len {CVE-2026-68433} * CVE-2026-68434 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms {CVE-2026-68434} * CVE-2026-68446 - drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446} * CVE-2026-68449 - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning {CVE-2026-68449} * CVE-2026-68451 - s390/zcrypt: Validate length for CCA ECC private key requests {CVE-2026-68451} * CVE-2026-68452 - s390/zcrypt: Validate length for CCA AES cipher key requests {CVE-2026-68452} * CVE-2026-68476 - ipvs: reload ip header after head reallocation {CVE-2026-68476} * CVE-2026-68480 - x86/bugs: Make Safe-RET robust against interrupt injection {CVE-2026-68480} * CVE-2026-72015 - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list {CVE-2026-72015} * CVE-2026-72019 - macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019} * CVE-2026-72023 - octeontx2-pf: fix SQB pointer leak on init failure {CVE-2026-72023} * CVE-2026-72035 - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72035} * CVE-2026-72041 - espintcp: use sk_msg_free_partial to fix partial send {CVE-2026-72041} * CVE-2026-72051 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051} * CVE-2026-72053 - net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053} * CVE-2026-72063 - gpio: tegra: do not call pinctrl for GPIO direction {CVE-2026-72063} * CVE-2026-72066 - cpu: hotplug: Bound hotplug states sysfs output {CVE-2026-72066} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-72073 - mmc: vub300: fix use-after-free on probe failure {CVE-2026-72073} * CVE-2026-72075 - Input: ims-pcu - fix race condition in reset_device sysfs callback {CVE-2026-72075} * CVE-2026-72077 - Input: ims-pcu - fix firmware leak in async update {CVE-2026-72077} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-72087 - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() {CVE-2026-72087} * CVE-2026-72096 - dm-verity: make error counter atomic {CVE-2026-72096} * CVE-2026-72099 - dm-integrity: don't increment hash_offset twice {CVE-2026-72099} * CVE-2026-72113 - can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113} * CVE-2026-72114 - can: bcm: validate frame length in bcm_rx_setup() for RTR replies {CVE-2026-72114} * CVE-2026-72115 - can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115} * CVE-2026-72116 - can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116} * CVE-2026-72117 - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117} * CVE-2026-72118 - can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118} * CVE-2026-72119 - can: bcm: extend bcm_tx_lock usage for data and timer updates {CVE-2026-72119} * CVE-2026-72121 - can: bcm: add locking when updating filter and timer values {CVE-2026-72121} * CVE-2026-72123 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF {CVE-2026-72123} * CVE-2026-72124 - can: isotp: serialize TX state transitions under so->rx_lock {CVE-2026-72124} - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering {CVE-2026-72124} * CVE-2026-72125 - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125} * CVE-2026-72142 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) {CVE-2026-72142} * CVE-2026-72148 - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK {CVE-2026-72148} * CVE-2026-72152 - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() {CVE-2026-72152} * CVE-2026-72155 - mtd: spi-nor: swp: Improve locking user experience {CVE-2026-72155} * CVE-2026-72157 - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} * CVE-2026-72166 - net/9p: fix infinite loop in p9_client_rpc on fatal signal {CVE-2026-72166} * CVE-2026-72168 - mtd: maps: vmu-flash: fix fault in unaligned fixup {CVE-2026-72168} * CVE-2026-72170 - 9p: skip nlink update in cacheless mode to fix WARN_ON {CVE-2026-72170} * CVE-2026-72181 - mips: sched: Fix CPUMASK_OFFSTACK memory corruption {CVE-2026-72181} * CVE-2026-72225 - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() {CVE-2026-72225} * CVE-2026-72242 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() {CVE-2026-72242} * CVE-2026-72253 - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it {CVE-2026-72253} * CVE-2026-72299 - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} * CVE-2026-72308 - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-72392 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump {CVE-2026-72392} * CVE-2026-74436 - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} * CVE-2026-74443 - drm/vmwgfx: bound DMA command body size against suffix pointer {CVE-2026-74443} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-74453 - drm/vc4: Zero the tile state data array before each BIN job {CVE-2026-74453} * CVE-2026-74455 - can: peak_usb: validate uCAN receive record lengths {CVE-2026-74455} * CVE-2026-74456 - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456} * CVE-2026-74457 - can: peak_usb: add bounds check for USB channel index {CVE-2026-74457} * CVE-2026-74458 - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents {CVE-2026-74458} * CVE-2026-74463 - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock {CVE-2026-74463} * CVE-2026-74464 - net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464} * CVE-2026-74465 - net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465} * CVE-2026-74468 - gpio: pch: use raw_spinlock_t for the register lock {CVE-2026-74468} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74470 - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470} * CVE-2026-74471 - tracing: Check return value of __register_event() in trace_module_add_events() {CVE-2026-74471} * CVE-2026-74473 - vxlan: use pskb_network_may_pull() in route_shortcircuit() {CVE-2026-74473} * CVE-2026-74475 - vxlan: use neigh_ha_snapshot() in route_shortcircuit() {CVE-2026-74475} * CVE-2026-74478 - um: vector: fix use-after-free in vector_mmsg_rx() {CVE-2026-74478} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} * CVE-2026-74481 - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} * CVE-2026-74482 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios {CVE-2026-74482} * CVE-2026-74485 - binfmt_misc: reject a flag character as the field delimiter {CVE-2026-74485} * CVE-2026-74486 - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone {CVE-2026-74486} * CVE-2026-74487 - binfmt_misc: restore write access when removing an entry {CVE-2026-74487} * CVE-2026-74488 - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames {CVE-2026-74488} * CVE-2026-74490 - tipc: avoid use-after-free in poll trace queue dumps {CVE-2026-74490} * CVE-2026-74492 - netfilter: ipset: do not update comments from kernel-side hash adds {CVE-2026-74492} * CVE-2026-74493 - net/smc: fix socket use-after-free during link group termination {CVE-2026-74493} * CVE-2026-74495 - igbvf: Fix leak in TX DMA error cleanup {CVE-2026-74495} * CVE-2026-74497 - ALSA: usb-audio: Clamp frame size in implicit-feedback mode {CVE-2026-74497} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74507 - Bluetooth: HIDP: validate numbered report payloads {CVE-2026-74507} * CVE-2026-74508 - Bluetooth: HIDP: reject frames without a transaction header {CVE-2026-74508} * CVE-2026-74512 - audit: fix potential use-after-free in audit_del_rule() {CVE-2026-74512} * CVE-2026-74518 - mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518} * CVE-2026-74519 - pinctrl: devicetree: don't free uninitialized dev_name on error path {CVE-2026-74519} * CVE-2026-74523 - qede: sync udp_tunnel ports outside qede_lock in the recovery path {CVE-2026-74523} * CVE-2026-74525 - net: sxgbe: free TX rings on RX allocation failure {CVE-2026-74525} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2026-74547 - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread {CVE-2026-74547} * CVE-2026-74548 - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548} * CVE-2026-74549 - hwmon: (nct6775-core) Prevent access to unsupported weight registers {CVE-2026-74549} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-74557 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer {CVE-2026-74557} * CVE-2026-74563 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() {CVE-2026-74563} * CVE-2026-74564 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH {CVE-2026-74564} * CVE-2026-74566 - keys: make keyring key-chunk byte order agree with keyring_diff_objects() {CVE-2026-74566} * CVE-2026-74567 - keys: fix out-of-bounds read in keyring_get_key_chunk() {CVE-2026-74567} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-74575 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} * CVE-2026-74577 - net: mpls: initialize rtm_tos in mpls_getroute() {CVE-2026-74577} * CVE-2026-74579 - netfilter: nft_payload: fix mask build for partial field offload {CVE-2026-74579} * CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} * CVE-2026-74581 - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} * CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-74585 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports {CVE-2026-74585} * CVE-2026-74586 - sctp: clear new_transport when removing a peer {CVE-2026-74586} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-74589 - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} * CVE-2026-74594 - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() {CVE-2026-74594} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-74598 - ipv6: fix Route Information option length validation {CVE-2026-74598} * CVE-2026-74599 - mm/ptdump: always stabilise against page table freeing using init_mm {CVE-2026-74599} * CVE-2026-74601 - ring-buffer: Use current_context for safe per-CPU buffer swap {CVE-2026-74601} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-74613 - vsock/virtio: avoid refilling the RX queue after teardown {CVE-2026-74613} * CVE-2026-74615 - vxlan: do not arm the ageing timer on a device that is down {CVE-2026-74615} * CVE-2026-74620 - net/sched: act_gact, act_police: range check the fallback control action {CVE-2026-74620} * CVE-2026-74622 - net: atlantic: free RX pages of consumed but not refilled buffers {CVE-2026-74622} * CVE-2026-74623 - net: atlantic: free stranded TX buffers on ring deinit {CVE-2026-74623} * CVE-2026-74625 - netfilter: bridge: release template ct on non-IP path {CVE-2026-74625} * CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure {CVE-2026-74626} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74631 - net: smc: fix splice entry lifetime imbalance in smc_rx_splice {CVE-2026-74631} * CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race {CVE-2026-74632} * CVE-2026-74635 - fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation {CVE-2026-74647} * CVE-2026-74648 - staging: rtl8723bs: validate monitor transmit frame lengths {CVE-2026-74648} * CVE-2026-74650 - staging: rtl8723bs: fix OOB read in WMM_param_handler() {CVE-2026-74650} * CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651} * CVE-2026-74654 - serial: 8250_dma: Clear stale RX state on shutdown {CVE-2026-74654} * CVE-2026-74656 - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} * CVE-2026-74657 - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops {CVE-2026-74657} * CVE-2026-74658 - futex: Prevent robust futex exit race some more {CVE-2026-74658} * CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} * CVE-2026-74662 - inet: frags: publish queues before arming timer {CVE-2026-74662} * CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies {CVE-2026-74663} * CVE-2026-74664 - net: openvswitch: reallocate update replies for mismatched IDs {CVE-2026-74664} * CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration {CVE-2026-74666} * CVE-2026-74667 - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} * CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path {CVE-2026-74668} * CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} * CVE-2026-74671 - ima: fix out-of-bounds read in xattr_verify() {CVE-2026-74671} * CVE-2026-74673 - Input: evdev - fix information leak in evdev_pass_values() {CVE-2026-74673} * CVE-2026-74675 - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get {CVE-2026-74675} * CVE-2026-74676 - vt: add permission check for KDSKBMETA ioctl {CVE-2026-74676} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-74680 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() {CVE-2026-74680} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-74683 - Input: evdev - sanitize event type index when fetching event masks {CVE-2026-74683} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-74693 - net: prestera: validate firmware header length {CVE-2026-74693} * CVE-2026-74694 - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length {CVE-2026-74694} * CVE-2026-74697 - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption {CVE-2026-74697} * CVE-2026-74701 - net/openvswitch: check Ethernet header length in key_extract() {CVE-2026-74701} * CVE-2026-74704 - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} * CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} * CVE-2026-74717 - net/mlx5: fw_tracer, return NULL on create error {CVE-2026-74717} * CVE-2026-74719 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() {CVE-2026-74719} * CVE-2026-74720 - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} * CVE-2026-74726 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor {CVE-2026-74726} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-74737 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG {CVE-2026-74737} * CVE-2026-74746 - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} * CVE-2026-74748 - netfilter: ipset: fix refcount race between list:set GC and swap {CVE-2026-74748} * CVE-2026-80527 - ceph: fix hanging __ceph_get_caps() with stale mds_wanted {CVE-2026-80527} * CVE-2026-80528 - ceph: avoid fs reclaim while using current->journal_info {CVE-2026-80528} * CVE-2026-80534 - xfs: fix ilock leak on error in xfs_dq_get_next_id {CVE-2026-80534} * CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} * CVE-2026-80540 - drm/amdgpu: Fix UVD decode image min size calculation {CVE-2026-80540} * CVE-2026-80541 - drm/amdgpu: validate GEM_CREATE domain combinations {CVE-2026-80541} * CVE-2026-80550 - s390/vfio_ccw: Fix out of bounds check on CCW array {CVE-2026-80550} * CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues {CVE-2026-80553} * CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails {CVE-2026-80555} * CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check {CVE-2026-80557} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-80559 - Input: sur40 - fix input device registration ordering {CVE-2026-80559} * CVE-2026-80560 - openrisc: signal: do not restore privileged SR bits on sigreturn {CVE-2026-80560} * CVE-2026-80561 - libceph: fix multiple unsafe decodes in decode_locker() {CVE-2026-80561} * CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock {CVE-2026-80562} * CVE-2026-80565 - crypto: qce - fix error path in devm_qce_register_algs {CVE-2026-80565} * CVE-2026-80567 - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue {CVE-2026-80567} * CVE-2026-80568 - Input: synaptics-rmi4 - block s_input when F54 queue is busy {CVE-2026-80568} * CVE-2026-80569 - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer {CVE-2026-80569} * CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570} * CVE-2026-80573 - Input: iforce - validate input packet lengths {CVE-2026-80573} * CVE-2026-80574 - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet {CVE-2026-80574} * CVE-2026-80584 - s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584} * CVE-2026-80586 - mptcp: options: reset DSS fields in case of unexpected size {CVE-2026-80586} * CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} * CVE-2026-80679 - s390/dasd: Fix potential NULL pointer dereference {CVE-2026-80679} * CVE-2026-80680 - i2c: amd-mp2: Unregister callback on adapter add failure {CVE-2026-80680} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2026-80706 - can: softing: fw_parse(): validate firmware record spans {CVE-2026-80706} * CVE-2026-80707 - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer {CVE-2026-80707} * CVE-2026-80708 - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() {CVE-2026-80708} * CVE-2026-80714 - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} * CVE-2026-80716 - ALSA: pcm: wake linked drain waiters on unlink {CVE-2026-80716} * CVE-2026-80717 - sctp: validate Adaptation Indication parameter length {CVE-2026-80717} * CVE-2026-80718 - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() {CVE-2026-80718} * CVE-2026-80731 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown {CVE-2026-80737} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-80743 - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers {CVE-2026-80743} * CVE-2026-80744 - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path {CVE-2026-80744} * CVE-2026-80752 - Input: psxpad-spi - set driver data before use {CVE-2026-80752} * CVE-2026-80754 - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo {CVE-2026-80754} * CVE-2026-80756 - selinux: do not cancel a policy conversion that never started {CVE-2026-80756} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * Miscellaneous upstream changes - debian: build a version-unique source package (source format 1.0) - Linux 5.10.263 - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - Linux 5.10.264 - KVM: VMX: Make vmread_error_trampoline() uncallable from C code - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - btrfs: remove crc_check logic from free space - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - mac80211_hwsim: add 6GHz channels - wifi: cfg80211: validate PMSR measurement type data - wifi: cfg80211: reject unsupported PMSR FTM location requests - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: remove variable num_processed - drm/i915/gt: use correct selftest config symbol - can: j1939: fix lockless local-destination check - drm/i915/selftests: Fix GT PM sort comparators - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: gadget: snps-udc: fix device name leak on probe failure - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: option: add TDTECH MT5710-CN - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - wifi: mac80211: recalculate TIM when a station enters power save - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - net: bridge: vlan: add support for global options - net: bridge: vlan: add support for dumping global vlan options - net: bridge: vlan: fix vlan range dumps starting with pvid - net: stmmac: reset residual action in L3L4 filters on delete - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - hinic: remove unused ethtool RSS user configuration buffers - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - raw: use more conventional iterators - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/radeon: fix r100_copy_blit for large BOs - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - iommu/vt-d: Disallow SVA if page walk is not coherent - raw: remove unused variables from raw6_icmp_error() - raw: fix a typo in raw_icmp_error() - net: bridge: vlan: fix global vlan option range dumping - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets - media: uvcvideo: Fix sequence number when no EOF - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - assoc_array: trim the final shortcut word using the current chunk end - smb: client: fix buffer leaks in SMB1 read and write - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Create functions for updating readings and limits - hwmon: (adt7470) Fix some style issues - hwmon: (adt7470) Convert to use regmap - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - powerpc/boot: Fix simpleboot CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix treeboot-akebono CPU node lookup check - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - net: phylink: put link_gpio if phylink_create fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - net: sxgbe: check descriptor ring allocation failures - can: isotp: check register_netdevice_notifier() error in module init - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - pinctrl: bm1880: add missing select GENERIC_PINCONF - audit: fix potential integer overflow in audit_log_n_string() - bpf: lwt: Fix dst reference leak on reroute failure - ALSA: lx6464es: fix period byte count for 16-bit streams - ASoC: tas2562: fix DVC coefficient write order - ASoC: tas2562: fix broken entries in the volume lookup table - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - e1000: fix memory leak in e1000_probe() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - tracing/filters: Fix false positive match in regex_match_full() - selftests/clone3: fix wild pointer access of getline due to missing init - sctp: reject stale cookies with mismatched verification tags - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - drm/amdgpu: cap GTT size to physical RAM on APUs - net: openvswitch: fix skb leak on flow key update failure during recirculation - mount: honour SB_NOUSER in the new mount API - nfs4: take a reference on the nfs_client when running FREE_STATEID - ARM: npcm: Fix OF node refcount leaks in SMP setup - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/mlx5: Remove second FW tracer check - counter: microchip-tcb-capture: Fix DT channel validation - net: openvswitch: Fix kerneldoc warnings - net: openvswitch: fix kernel-doc warnings in flow.c - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - net: marvell: prestera: try to load previous fw version - sctp: remove the unessessary hold for idev in sctp_v6_err - sctp: extract sctp_v6_err_handle function from sctp_v6_err - sctp: extract sctp_v4_err_handle function from sctp_v4_err - tls: don't abort the connection on signal-interrupted sends - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - ALSA: usb-audio: Evaluate packsize caps at the right place - ipvs: add totalconns for dest - ipvs: properly update the overload flag on dest edit - fscrypt: Replace mk_users keyring with simple list - misc: fastrpc: fix channel ctx ref leak when session alloc fails - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - scsi: scsi_debug: Negate wrapped memcmp() result - prestera: fix fallback to previous version on same major version - hwmon: (adt7470) Add missing dependency on REGMAP_I2C - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - Linux 5.10.265 - ipvs: separate destination availability state - selinux: require every boolean value to be defined - ASoC: cs4265: sort the register default table - powerpc/pseries: pci - logic bug - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - powerpc/pseries: lparcfg - fix kbuf[] underflow - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - Input: sur40 - fix V4L error path cleanup - ceph: fix MDS random selection readiness predicate - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/radeon: fix autosuspend cleanup during teardown - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - xfs: check v5 superblock features early - udmabuf: Do not create malformed scatterlists - i2c: davinci: Unregister cpufreq notifier on probe failure - device property: Add fwnode_irq_get_byname - i2c: smbus: Use device_*() functions instead of of_*() - VFS/audit: introduce kern_path_parent() for audit - audit: widen ino fields to u64 - audit: use 'unsigned int' instead of 'unsigned' - ALSA: hda: Fix cached processing coefficient verbs - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: max310x: implement gpio_chip::get_direction() - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - mlxsw: spectrum: Apply RIF configuration when joining a LAG - mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - ASoC: mediatek: mt8183: Check runtime resume during probe - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - netfilter: nf_conntrack_sip: remove net variable shadowing - jbd2: add a helper to find out number of fast commit blocks - lsm: use default hook return value in call_int_hook() - lsm: infrastructure management of the sock security - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - mtd: spi-nor: sst: remove global protection flag - mtd: spi-nor: intel: remove global protection flag - mtd: spi-nor: Move Software Write Protection logic out of the core - mtd: spi-nor: Fix spi_nor_try_unlock_all() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - PCI: Add pci_find_vsec_capability() to find a specific VSEC - dmaengine: dw-edma: Improve the linked list and data blocks definition - dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip - i2c: imx: separate atomic, dma and non-dma use case - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Remove XDomain from the bus without holding tb->lock - ovl: use linked upper dentry in copy-up tmpfile - scsi: target: core: pr: Initialize arrays at declaration time - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - mmc: vub300: rename probe error labels - firmware_loader: introduce __free() cleanup hanler - net: Add helper function to parse netlink msg of ip_tunnel_encap - net/sched: taprio: avoid calling child->ops->dequeue(child) twice - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - net: ipa: fix SMEM state handle leaks in SMP2P init - usb: gadget: bdc: fix checkpatch.pl spacing error - USB: serial: keyspan_pda: refactor write-room handling - USB: serial: keyspan_pda: fix write implementation - USB: serial: keyspan_pda: add write-fifo support - USB: serial: keyspan_pda: clean up comments and whitespace - USB: serial: keyspan_pda: fix data loss on receive throttling - KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() - KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield - KVM: x86: Move "apicv_active" into "struct kvm_lapic" - KVM: Introduce vcpu->wants_to_run - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - dma-buf/drivers: make reserving a shared slot mandatory v4 - drm/virtio: use uninterruptible resv lock for plane updates - drm/displayid: fix Tiled Display Topology ID size - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/virtio: Return proper error codes instead of -1 - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - drm/i915/hdcp: require monotonically increasing seq_num_v - media: marvell-cam: fix missing pci_disable_device() on remove - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Correct the minimum vblanking value - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - media: v4l: async: Set owner for async sub-devices - serial: 8250_mid: Remove unneeded test for ->setup() presence - mptcp: only set DATA_FIN when a mapping is present - sc16is7xx: Properly resume TX after stop - serial: sc16is7xx: Fill in rs485_supported - serial: sc16is7xx: remove obsolete out_thread label - serial: sc16is7xx: fix regression with GPIO configuration - serial: sc16is7xx: implement gpio get_direction() callback - mptcp: fix subflow accounting on close - mptcp: decrement subflows counter on failed passive join - libceph: Amend checking to fix `make W=1` build breakage - libceph: add doutc and *_client debug macros support - ceph: rename _to_client() to _to_fs_client() - skbuff: introduce skb_pull_data - mm/vmstat: fold stranded per-cpu node stats when a node comes online - net: pktgen: fix code style (WARNING: Block comments) - scsi: sd: sd_zbc: Improve source code documentation - scsi: sd: sd_zbc: Use logical blocks as unit when querying zones - scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() - scsi: scsi_debug: Rename zone type constants - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - i2c: bcm-iproc: remove printout on handled timeouts - i2c: iproc: reset bus after timeout if START_BUSY is stuck - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - drm/amd/pm: fix torn gpu metrics reads - ALSA: usx2y: Fix potential leaks of uninitialized memory - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix list type element drift bug - net: packet: fix wrong transport_header when sending VLAN-tagged frame - net: ethernet: ti: am65-cpsw: move ale selection in pdata - net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata - net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode - net/smc: rdma write inline if qp has sufficient inline space - i2c: smbus: Check for parent device before dereference - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - Linux 5.10.266 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - rndis_host: add overflow check in rndis_rx_fixup() - ocfs2: fix missing metadata reservation for large xattrs - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - xfs: validate attr entry pointer before field access - misc: fastrpc: separate fastrpc device from channel context - misc: fastrpc: Rework fastrpc_req_munmap - net: ipv4: Publish fib_nlmsg_size() - perf: Fix cgroup state vs ERROR - perf: Fix dangling cgroup pointer in cpuctx - KVM: arm64: Retry fault if vma_lookup() results become invalid - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: free destination parameters when closing a connection - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" - can: use skb hash instead of private variable in headroom - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Revert "ALSA: aoa: Use guard() for mutex locks" - Linux 5.10.267 - Linux 5.10.268 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() - ext4: don't enable DAX on new encrypted files - io_uring/io-wq: fix worker accounting when canceling creation callbacks - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - selinux: switch two allocations to use kzalloc_objs() - Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" - Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: propagate errors from fast commit range replay - nilfs2: reject invalid block index in GC ioctl - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - HID: magicmouse: do not keep a stale msc->input if no input is claimed - nfc: nci: add data_len bound checks to activation parameter extractors - nvmet-tcp: bound SGL data length before allocating command buffers - HID: input: read battery capacity from its actual report offset - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - usb: usbtest: disable dynamic ID support - usb: gadget: f_tcm: keep port count until LUN teardown completes - xfrm: espintcp: fix UAF during close - xfrm: drop ESP-in-TCP packets with no ingress device - xfrm: ah6: validate routing header segments_left - xfrm: fix xfrm_state_construct() auth-trunc leak - ipv6: seg6: clear IPv4 control block on IPIP decapsulation - mm/swap: reject swapon() on filesystem-level encrypted files - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: mxs-dcp - fix source scatterlist length access - KVM: s390: vsie: zero stale crypto bits - usb: core: Add lock to usb_wakeup_notification() - usb: core: Strengthen error handling in hub_hub_status() - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() - USB: serial: option: fix slab OOB read in interrupt URB callback - USB: serial: spcp8x5: drop broken carrier detect support - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() - usb: usbfs: fix use-after-free of usb_device in usbdev_release() - Linux 5.10.269 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Update to upstream stable Linux 5.10.269 (from 5.10.262). * Bump kernel ABI to 48: ship the ELS kernel as 5.10.0-48-*, distinct from the prior 5.10.0-47. * CVE-2024-40973 - media: mtk-vcodec: potential null pointer deference in SCP {CVE-2024-40973} * CVE-2024-46754 - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754} * CVE-2024-50125 - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125} * CVE-2024-58094 - jfs: add check read-only before truncation in jfs_truncate_nolock() {CVE-2024-58094} * CVE-2024-58095 - jfs: add check read-only before txBeginAnon() call {CVE-2024-58095} * CVE-2024-58240 - tls: separate no-async decryption request handling from async {CVE-2024-58240} * CVE-2025-23160 - media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization {CVE-2025-23160} * CVE-2025-38524 - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524} * CVE-2025-40054 - f2fs: fix UAF issue in f2fs_merge_page_bio() {CVE-2025-40054} * CVE-2025-40102 - KVM: arm64: Prevent access to vCPU events before init {CVE-2025-40102} * CVE-2025-68794 - iomap: adjust read range correctly for non-block-aligned positions {CVE-2025-68794} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2026-31650 - mmc: vub300: fix use-after-free on disconnect {CVE-2026-31650} * CVE-2026-43491 - net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491} * CVE-2026-45839 - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() {CVE-2026-45839} * CVE-2026-46003 - net: qrtr: ns: Raise node count limit to 512 {CVE-2026-46003} * CVE-2026-46026 - net: qrtr: ns: Raise lookup limit to 128 {CVE-2026-46026} * CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} * CVE-2026-53090 - bpf: Fix ld_{abs,ind} failure path analysis in subprogs {CVE-2026-53090} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-64048 - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot {CVE-2026-64048} * CVE-2026-64192 - bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized {CVE-2026-64192} * CVE-2026-64269 - RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg {CVE-2026-64269} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64280 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280} * CVE-2026-64336 - USB: serial: keyspan_pda: fix information leak {CVE-2026-64336} * CVE-2026-64371 - proc: Fix broken error paths for namespace links {CVE-2026-64371} * CVE-2026-64427 - HID: logitech-dj: Fix maxfield check in DJ short report validation {CVE-2026-64427} * CVE-2026-64434 - Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref {CVE-2026-64434} - Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev {CVE-2026-64434} * CVE-2026-64535 - nvmet-tcp: Fix potential UAF when ddgst mismatch {CVE-2026-64535} * CVE-2026-64543 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} * CVE-2026-64562 - KVM: nVMX: Hide shadow VMCS right after VMCLEAR {CVE-2026-64562} * CVE-2026-64563 - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} * CVE-2026-64565 - Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() {CVE-2026-64565} - Input: ims-pcu - fix logic error in packet reset {CVE-2026-64565} * CVE-2026-64567 - btrfs: reject free space cache with more entries than pages {CVE-2026-64567} * CVE-2026-64569 - mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n {CVE-2026-64569} * CVE-2026-64571 - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() {CVE-2026-64571} * CVE-2026-64572 - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} * CVE-2026-64579 - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} * CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() {CVE-2026-64581} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-64584 - usb: gadget: f_midi: cancel pending IN work before freeing the midi object {CVE-2026-64584} * CVE-2026-64586 - wifi: brcmfmac: drain bus_reset work on device removal {CVE-2026-64586} * CVE-2026-64590 - dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning {CVE-2026-64590} - udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() {CVE-2026-64590} * CVE-2026-68082 - libceph: fix two unsafe bare decodes in decode_lockers() {CVE-2026-68082} * CVE-2026-68096 - audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096} * CVE-2026-68104 - drm/amdgpu: invoke pm_genpd_remove() before freeing genpd {CVE-2026-68104} * CVE-2026-68106 - drm/amdgpu: fix division by zero with invalid uvd dimensions {CVE-2026-68106} * CVE-2026-68111 - drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() {CVE-2026-68111} * CVE-2026-68115 - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115} * CVE-2026-68117 - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() {CVE-2026-68117} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-68123 - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} * CVE-2026-68125 - mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125} * CVE-2026-68127 - ila: reload IPv6 header after pskb_may_pull in checksum adjust {CVE-2026-68127} * CVE-2026-68131 - rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131} * CVE-2026-68132 - super: fix emergency thaw deadlock on frozen block devices {CVE-2026-68132} * CVE-2026-68135 - net: hip04: fix RX buffer leak on build_skb failure {CVE-2026-68135} * CVE-2026-68136 - net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136} * CVE-2026-68137 - net/x25: fix use-after-free in x25_kill_by_neigh() {CVE-2026-68137} * CVE-2026-68138 - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} * CVE-2026-68140 - net/iucv: fix use-after-free of a severed iucv_path {CVE-2026-68140} * CVE-2026-68141 - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() {CVE-2026-68141} * CVE-2026-68142 - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-68146 - ftrace: Add global mutex to serialize trace_parser access {CVE-2026-68146} * CVE-2026-68151 - binfmt_elf_fdpic: only honour the first PT_INTERP {CVE-2026-68151} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-68154 - libceph: reject zero bucket types in crush_decode {CVE-2026-68154} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2026-68157 - libceph: guard missing CRUSH type name lookup {CVE-2026-68157} * CVE-2026-68158 - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} * CVE-2026-68159 - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-68162 - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} * CVE-2026-68175 - tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175} * CVE-2026-68176 - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} * CVE-2026-68180 - intel_th: fix MSC output device reference leak {CVE-2026-68180} * CVE-2026-68182 - comedi: comedi_parport: deal with premature interrupt {CVE-2026-68182} * CVE-2026-68183 - firmware: stratix10-svc: fix memory leaks and list corruption bugs {CVE-2026-68183} * CVE-2026-68184 - cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184} * CVE-2026-68186 - binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186} * CVE-2026-68187 - exec: fix unsigned loop counter wrap in transfer_args_to_stack() {CVE-2026-68187} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-68192 - wifi: brcmfmac: make release_scratchbuffers idempotent {CVE-2026-68192} * CVE-2026-68195 - wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses {CVE-2026-68195} * CVE-2026-68196 - wifi: wilc1000: validate assoc response length before subtracting header {CVE-2026-68196} * CVE-2026-68197 - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-68204 - media: vivid: check for vb2_is_busy() when toggling caps {CVE-2026-68204} * CVE-2026-68205 - media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor() {CVE-2026-68205} * CVE-2026-68209 - media: sun4i-csi: Return queued buffers on start_streaming() failure {CVE-2026-68209} * CVE-2026-68212 - media: saa7134: Fix a possible memory leak in saa7134_video_init1 {CVE-2026-68212} * CVE-2026-68213 - media: rtl2832_sdr: Return queued buffers on start_streaming() failure {CVE-2026-68213} * CVE-2026-68214 - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} * CVE-2026-68215 - media: radio-si476x: Unregister v4l2_device on probe failure {CVE-2026-68215} * CVE-2026-68216 - media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216} * CVE-2026-68217 - media: pwc: Drain fill_buf on start_streaming() failure {CVE-2026-68217} * CVE-2026-68218 - media: pci: dm1105: Free allocated workqueue {CVE-2026-68218} * CVE-2026-68222 - media: msi2500: Return queued buffers on start_streaming() failure {CVE-2026-68222} * CVE-2026-68223 - media: meson: vdec: Fix memory leak in error path of vdec_open {CVE-2026-68223} * CVE-2026-68226 - media: cx23885: add ioremap return check and cleanup {CVE-2026-68226} * CVE-2026-68227 - media: cx231xx: fix devres lifetime {CVE-2026-68227} * CVE-2026-68229 - media: cedrus: skip invalid H.264 reference list entries {CVE-2026-68229} * CVE-2026-68231 - media: airspy: Return queued buffers on start_streaming() failure {CVE-2026-68231} * CVE-2026-68234 - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234} * CVE-2026-68249 - drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() {CVE-2026-68249} * CVE-2026-68250 - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() {CVE-2026-68250} * CVE-2026-68255 - drm/virtio: bound EDID block reads to the response buffer {CVE-2026-68255} * CVE-2026-68277 - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers {CVE-2026-68277} * CVE-2026-68278 - drm/dp/mst: fix buffer overflows in sideband chunk accumulation {CVE-2026-68278} * CVE-2026-68279 - drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers {CVE-2026-68279} * CVE-2026-68284 - bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() {CVE-2026-68284} * CVE-2026-68294 - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} * CVE-2026-68297 - tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297} * CVE-2026-68299 - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets {CVE-2026-68299} * CVE-2026-68300 - sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300} * CVE-2026-68304 - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304} * CVE-2026-68313 - tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313} * CVE-2026-68315 - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-68322 - rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled {CVE-2026-68322} * CVE-2026-68325 - iommu/amd: Bound the early ACPI HID map {CVE-2026-68325} * CVE-2026-68326 - wifi: mwifiex: bound uAP association event IEs to the event buffer {CVE-2026-68326} * CVE-2026-68327 - wan: wanxl: Only reset hardware after BAR mapping {CVE-2026-68327} * CVE-2026-68328 - nfp: Check resource mutex allocation {CVE-2026-68328} * CVE-2026-68335 - rds: drop incoming messages that cross network namespace boundaries {CVE-2026-68335} * CVE-2026-68338 - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} * CVE-2026-68344 - usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect {CVE-2026-68344} * CVE-2026-68349 - wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349} * CVE-2026-68350 - wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350} * CVE-2026-68351 - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351} * CVE-2026-68352 - wifi: ath6kl: fix OOB read from firmware IE lengths in connect event {CVE-2026-68352} * CVE-2026-68353 - wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler {CVE-2026-68353} * CVE-2026-68354 - firewire: net: Fix fragmented datagram reassembly {CVE-2026-68354} * CVE-2026-68355 - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355} * CVE-2026-68357 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357} * CVE-2026-68360 - hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop {CVE-2026-68360} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-68365 - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} * CVE-2026-68366 - usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer {CVE-2026-68366} * CVE-2026-68367 - usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367} * CVE-2026-68368 - usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() {CVE-2026-68368} * CVE-2026-68369 - usb: gadget: printer: fix infinite loop in printer_read() {CVE-2026-68369} * CVE-2026-68370 - usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback {CVE-2026-68370} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-68377 - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} * CVE-2026-68388 - smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388} * CVE-2026-68395 - ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered {CVE-2026-68395} * CVE-2026-68397 - net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397} * CVE-2026-68402 - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} * CVE-2026-68403 - wifi: brcmfmac: initialize SDIO data work before cleanup {CVE-2026-68403} * CVE-2026-68405 - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405} * CVE-2026-68406 - wifi: cfg80211: validate PMSR FTM preamble range {CVE-2026-68406} * CVE-2026-68410 - wifi: libertas: fix memory leak in helper_firmware_cb() {CVE-2026-68410} * CVE-2026-68411 - wifi: mac80211_hwsim: clamp virtio RX length before skb_put {CVE-2026-68411} * CVE-2026-68413 - wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413} * CVE-2026-68425 - IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425} * CVE-2026-68428 - KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428} * CVE-2026-68430 - drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430} * CVE-2026-68432 - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} * CVE-2026-68433 - libceph: bound get_version reply decode to front len {CVE-2026-68433} * CVE-2026-68434 - serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms {CVE-2026-68434} * CVE-2026-68446 - drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446} * CVE-2026-68449 - ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning {CVE-2026-68449} * CVE-2026-68451 - s390/zcrypt: Validate length for CCA ECC private key requests {CVE-2026-68451} * CVE-2026-68452 - s390/zcrypt: Validate length for CCA AES cipher key requests {CVE-2026-68452} * CVE-2026-68476 - ipvs: reload ip header after head reallocation {CVE-2026-68476} * CVE-2026-68480 - x86/bugs: Make Safe-RET robust against interrupt injection {CVE-2026-68480} * CVE-2026-72015 - fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list {CVE-2026-72015} * CVE-2026-72019 - macsec: don't read an unset MAC header in macsec_encrypt() {CVE-2026-72019} * CVE-2026-72023 - octeontx2-pf: fix SQB pointer leak on init failure {CVE-2026-72023} * CVE-2026-72035 - net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-72035} * CVE-2026-72041 - espintcp: use sk_msg_free_partial to fix partial send {CVE-2026-72041} * CVE-2026-72051 - net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051} * CVE-2026-72053 - net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053} * CVE-2026-72063 - gpio: tegra: do not call pinctrl for GPIO direction {CVE-2026-72063} * CVE-2026-72066 - cpu: hotplug: Bound hotplug states sysfs output {CVE-2026-72066} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-72073 - mmc: vub300: fix use-after-free on probe failure {CVE-2026-72073} * CVE-2026-72075 - Input: ims-pcu - fix race condition in reset_device sysfs callback {CVE-2026-72075} * CVE-2026-72077 - Input: ims-pcu - fix firmware leak in async update {CVE-2026-72077} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-72087 - scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() {CVE-2026-72087} * CVE-2026-72096 - dm-verity: make error counter atomic {CVE-2026-72096} * CVE-2026-72099 - dm-integrity: don't increment hash_offset twice {CVE-2026-72099} * CVE-2026-72113 - can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113} * CVE-2026-72114 - can: bcm: validate frame length in bcm_rx_setup() for RTR replies {CVE-2026-72114} * CVE-2026-72115 - can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115} * CVE-2026-72116 - can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116} * CVE-2026-72117 - can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117} * CVE-2026-72118 - can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118} * CVE-2026-72119 - can: bcm: extend bcm_tx_lock usage for data and timer updates {CVE-2026-72119} * CVE-2026-72121 - can: bcm: add locking when updating filter and timer values {CVE-2026-72121} * CVE-2026-72123 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF {CVE-2026-72123} * CVE-2026-72124 - can: isotp: serialize TX state transitions under so->rx_lock {CVE-2026-72124} - can: isotp: fix timer drain order, wakeup handling and tx_gen ordering {CVE-2026-72124} * CVE-2026-72125 - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125} * CVE-2026-72142 - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) {CVE-2026-72142} * CVE-2026-72148 - dmaengine: dw-edma: Add spinlock to protect DONE_INT_MASK and ABORT_INT_MASK {CVE-2026-72148} * CVE-2026-72152 - tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() {CVE-2026-72152} * CVE-2026-72155 - mtd: spi-nor: swp: Improve locking user experience {CVE-2026-72155} * CVE-2026-72157 - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} * CVE-2026-72166 - net/9p: fix infinite loop in p9_client_rpc on fatal signal {CVE-2026-72166} * CVE-2026-72168 - mtd: maps: vmu-flash: fix fault in unaligned fixup {CVE-2026-72168} * CVE-2026-72170 - 9p: skip nlink update in cacheless mode to fix WARN_ON {CVE-2026-72170} * CVE-2026-72181 - mips: sched: Fix CPUMASK_OFFSTACK memory corruption {CVE-2026-72181} * CVE-2026-72225 - jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() {CVE-2026-72225} * CVE-2026-72242 - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() {CVE-2026-72242} * CVE-2026-72253 - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it {CVE-2026-72253} * CVE-2026-72299 - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} * CVE-2026-72308 - mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-72392 - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump {CVE-2026-72392} * CVE-2026-74436 - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} * CVE-2026-74443 - drm/vmwgfx: bound DMA command body size against suffix pointer {CVE-2026-74443} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-74453 - drm/vc4: Zero the tile state data array before each BIN job {CVE-2026-74453} * CVE-2026-74455 - can: peak_usb: validate uCAN receive record lengths {CVE-2026-74455} * CVE-2026-74456 - can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456} * CVE-2026-74457 - can: peak_usb: add bounds check for USB channel index {CVE-2026-74457} * CVE-2026-74458 - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents {CVE-2026-74458} * CVE-2026-74463 - i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock {CVE-2026-74463} * CVE-2026-74464 - net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464} * CVE-2026-74465 - net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465} * CVE-2026-74468 - gpio: pch: use raw_spinlock_t for the register lock {CVE-2026-74468} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74470 - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470} * CVE-2026-74471 - tracing: Check return value of __register_event() in trace_module_add_events() {CVE-2026-74471} * CVE-2026-74473 - vxlan: use pskb_network_may_pull() in route_shortcircuit() {CVE-2026-74473} * CVE-2026-74475 - vxlan: use neigh_ha_snapshot() in route_shortcircuit() {CVE-2026-74475} * CVE-2026-74478 - um: vector: fix use-after-free in vector_mmsg_rx() {CVE-2026-74478} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} * CVE-2026-74481 - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} * CVE-2026-74482 - mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios {CVE-2026-74482} * CVE-2026-74485 - binfmt_misc: reject a flag character as the field delimiter {CVE-2026-74485} * CVE-2026-74486 - binfmt_misc: use exe_file_deny_write_access() for the interpreter clone {CVE-2026-74486} * CVE-2026-74487 - binfmt_misc: restore write access when removing an entry {CVE-2026-74487} * CVE-2026-74488 - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames {CVE-2026-74488} * CVE-2026-74490 - tipc: avoid use-after-free in poll trace queue dumps {CVE-2026-74490} * CVE-2026-74492 - netfilter: ipset: do not update comments from kernel-side hash adds {CVE-2026-74492} * CVE-2026-74493 - net/smc: fix socket use-after-free during link group termination {CVE-2026-74493} * CVE-2026-74495 - igbvf: Fix leak in TX DMA error cleanup {CVE-2026-74495} * CVE-2026-74497 - ALSA: usb-audio: Clamp frame size in implicit-feedback mode {CVE-2026-74497} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74507 - Bluetooth: HIDP: validate numbered report payloads {CVE-2026-74507} * CVE-2026-74508 - Bluetooth: HIDP: reject frames without a transaction header {CVE-2026-74508} * CVE-2026-74512 - audit: fix potential use-after-free in audit_del_rule() {CVE-2026-74512} * CVE-2026-74518 - mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518} * CVE-2026-74519 - pinctrl: devicetree: don't free uninitialized dev_name on error path {CVE-2026-74519} * CVE-2026-74523 - qede: sync udp_tunnel ports outside qede_lock in the recovery path {CVE-2026-74523} * CVE-2026-74525 - net: sxgbe: free TX rings on RX allocation failure {CVE-2026-74525} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2026-74547 - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread {CVE-2026-74547} * CVE-2026-74548 - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548} * CVE-2026-74549 - hwmon: (nct6775-core) Prevent access to unsupported weight registers {CVE-2026-74549} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-74557 - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer {CVE-2026-74557} * CVE-2026-74563 - rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() {CVE-2026-74563} * CVE-2026-74564 - netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH {CVE-2026-74564} * CVE-2026-74566 - keys: make keyring key-chunk byte order agree with keyring_diff_objects() {CVE-2026-74566} * CVE-2026-74567 - keys: fix out-of-bounds read in keyring_get_key_chunk() {CVE-2026-74567} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-74575 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} * CVE-2026-74577 - net: mpls: initialize rtm_tos in mpls_getroute() {CVE-2026-74577} * CVE-2026-74579 - netfilter: nft_payload: fix mask build for partial field offload {CVE-2026-74579} * CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} * CVE-2026-74581 - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} * CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-74585 - thunderbolt: Bound the DROM dual link port number before indexing sw->ports {CVE-2026-74585} * CVE-2026-74586 - sctp: clear new_transport when removing a peer {CVE-2026-74586} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-74589 - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} * CVE-2026-74594 - sched/psi: Shut down rtpoll_timer in psi_cgroup_free() {CVE-2026-74594} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-74598 - ipv6: fix Route Information option length validation {CVE-2026-74598} * CVE-2026-74599 - mm/ptdump: always stabilise against page table freeing using init_mm {CVE-2026-74599} * CVE-2026-74601 - ring-buffer: Use current_context for safe per-CPU buffer swap {CVE-2026-74601} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-74613 - vsock/virtio: avoid refilling the RX queue after teardown {CVE-2026-74613} * CVE-2026-74615 - vxlan: do not arm the ageing timer on a device that is down {CVE-2026-74615} * CVE-2026-74620 - net/sched: act_gact, act_police: range check the fallback control action {CVE-2026-74620} * CVE-2026-74622 - net: atlantic: free RX pages of consumed but not refilled buffers {CVE-2026-74622} * CVE-2026-74623 - net: atlantic: free stranded TX buffers on ring deinit {CVE-2026-74623} * CVE-2026-74625 - netfilter: bridge: release template ct on non-IP path {CVE-2026-74625} * CVE-2026-74626 - NTB: ntb_netdev: Preserve RX queue depth on allocation failure {CVE-2026-74626} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74631 - net: smc: fix splice entry lifetime imbalance in smc_rx_splice {CVE-2026-74631} * CVE-2026-74632 - mm/huge_memory: fix huge_zero_pfn race {CVE-2026-74632} * CVE-2026-74635 - fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-74647 - misc: fastrpc: Remove buffer from list prior to unmap operation {CVE-2026-74647} * CVE-2026-74648 - staging: rtl8723bs: validate monitor transmit frame lengths {CVE-2026-74648} * CVE-2026-74650 - staging: rtl8723bs: fix OOB read in WMM_param_handler() {CVE-2026-74650} * CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651} * CVE-2026-74654 - serial: 8250_dma: Clear stale RX state on shutdown {CVE-2026-74654} * CVE-2026-74656 - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} * CVE-2026-74657 - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops {CVE-2026-74657} * CVE-2026-74658 - futex: Prevent robust futex exit race some more {CVE-2026-74658} * CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} * CVE-2026-74662 - inet: frags: publish queues before arming timer {CVE-2026-74662} * CVE-2026-74663 - net/sched: reject overly deep qdisc hierarchies {CVE-2026-74663} * CVE-2026-74664 - net: openvswitch: reallocate update replies for mismatched IDs {CVE-2026-74664} * CVE-2026-74666 - packet: synchronize pressure clearing with ring reconfiguration {CVE-2026-74666} * CVE-2026-74667 - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} * CVE-2026-74668 - packet: use consistent hard_header_len in TX_RING send path {CVE-2026-74668} * CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} * CVE-2026-74671 - ima: fix out-of-bounds read in xattr_verify() {CVE-2026-74671} * CVE-2026-74673 - Input: evdev - fix information leak in evdev_pass_values() {CVE-2026-74673} * CVE-2026-74675 - vt: stabilize tty reference in kbd_keycode with tty_port_tty_get {CVE-2026-74675} * CVE-2026-74676 - vt: add permission check for KDSKBMETA ioctl {CVE-2026-74676} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-74680 - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() {CVE-2026-74680} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-74683 - Input: evdev - sanitize event type index when fetching event masks {CVE-2026-74683} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-74693 - net: prestera: validate firmware header length {CVE-2026-74693} * CVE-2026-74694 - net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length {CVE-2026-74694} * CVE-2026-74697 - bnxt_en: Disable EOP for TPA on all chips to prevent data corruption {CVE-2026-74697} * CVE-2026-74701 - net/openvswitch: check Ethernet header length in key_extract() {CVE-2026-74701} * CVE-2026-74704 - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} * CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} * CVE-2026-74717 - net/mlx5: fw_tracer, return NULL on create error {CVE-2026-74717} * CVE-2026-74719 - net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() {CVE-2026-74719} * CVE-2026-74720 - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} * CVE-2026-74726 - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor {CVE-2026-74726} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-74737 - net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG {CVE-2026-74737} * CVE-2026-74746 - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} * CVE-2026-74748 - netfilter: ipset: fix refcount race between list:set GC and swap {CVE-2026-74748} * CVE-2026-80527 - ceph: fix hanging __ceph_get_caps() with stale mds_wanted {CVE-2026-80527} * CVE-2026-80528 - ceph: avoid fs reclaim while using current->journal_info {CVE-2026-80528} * CVE-2026-80534 - xfs: fix ilock leak on error in xfs_dq_get_next_id {CVE-2026-80534} * CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} * CVE-2026-80540 - drm/amdgpu: Fix UVD decode image min size calculation {CVE-2026-80540} * CVE-2026-80541 - drm/amdgpu: validate GEM_CREATE domain combinations {CVE-2026-80541} * CVE-2026-80550 - s390/vfio_ccw: Fix out of bounds check on CCW array {CVE-2026-80550} * CVE-2026-80553 - s390/vfio_ccw: Cancel existing workqueues {CVE-2026-80553} * CVE-2026-80555 - s390/vfio_ccw: Free all memory if cp_init() fails {CVE-2026-80555} * CVE-2026-80557 - libceph: fix OOB read in decode_watchers() via missing bounds check {CVE-2026-80557} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-80559 - Input: sur40 - fix input device registration ordering {CVE-2026-80559} * CVE-2026-80560 - openrisc: signal: do not restore privileged SR bits on sigreturn {CVE-2026-80560} * CVE-2026-80561 - libceph: fix multiple unsafe decodes in decode_locker() {CVE-2026-80561} * CVE-2026-80562 - gpio: ml-ioh: use raw_spinlock_t for the register lock {CVE-2026-80562} * CVE-2026-80565 - crypto: qce - fix error path in devm_qce_register_algs {CVE-2026-80565} * CVE-2026-80567 - Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue {CVE-2026-80567} * CVE-2026-80568 - Input: synaptics-rmi4 - block s_input when F54 queue is busy {CVE-2026-80568} * CVE-2026-80569 - Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer {CVE-2026-80569} * CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570} * CVE-2026-80573 - Input: iforce - validate input packet lengths {CVE-2026-80573} * CVE-2026-80574 - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet {CVE-2026-80574} * CVE-2026-80584 - s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584} * CVE-2026-80586 - mptcp: options: reset DSS fields in case of unexpected size {CVE-2026-80586} * CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} * CVE-2026-80679 - s390/dasd: Fix potential NULL pointer dereference {CVE-2026-80679} * CVE-2026-80680 - i2c: amd-mp2: Unregister callback on adapter add failure {CVE-2026-80680} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2026-80706 - can: softing: fw_parse(): validate firmware record spans {CVE-2026-80706} * CVE-2026-80707 - can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer {CVE-2026-80707} * CVE-2026-80708 - s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() {CVE-2026-80708} * CVE-2026-80714 - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} * CVE-2026-80716 - ALSA: pcm: wake linked drain waiters on unlink {CVE-2026-80716} * CVE-2026-80717 - sctp: validate Adaptation Indication parameter length {CVE-2026-80717} * CVE-2026-80718 - mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() {CVE-2026-80718} * CVE-2026-80731 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown {CVE-2026-80737} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-80743 - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers {CVE-2026-80743} * CVE-2026-80744 - netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path {CVE-2026-80744} * CVE-2026-80752 - Input: psxpad-spi - set driver data before use {CVE-2026-80752} * CVE-2026-80754 - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo {CVE-2026-80754} * CVE-2026-80756 - selinux: do not cancel a policy conversion that never started {CVE-2026-80756} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * Miscellaneous upstream changes - debian: build a version-unique source package (source format 1.0) - Linux 5.10.263 - Revert "x86/bugs: Make Safe-RET robust against interrupt injection" - x86/bugs: Make Safe-RET robust against interrupt injection - Linux 5.10.264 - KVM: VMX: Make vmread_error_trampoline() uncallable from C code - mtd: mtdswap: remove debugfs stats file on teardown - mtd: nand: mtk-ecc: stop on ECC idle timeouts - btrfs: remove crc_check logic from free space - RDMA/hns: Fix potential integer overflow in mhop hem cleanup - mac80211_hwsim: add 6GHz channels - wifi: cfg80211: validate PMSR measurement type data - wifi: cfg80211: reject unsupported PMSR FTM location requests - ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop - ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup - firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context - ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts - ata: sata_dwc_460ex: remove variable num_processed - drm/i915/gt: use correct selftest config symbol - can: j1939: fix lockless local-destination check - drm/i915/selftests: Fix GT PM sort comparators - USB: storage: add NO_ATA_1X quirk for Longmai USB Key - usb: chipidea: fix usage_count leak when autosuspend_delay is negative - USB: gadget: snps-udc: fix device name leak on probe failure - USB: gadget: fsl-udc: fix device name leak on probe failure - USB: serial: ftdi_sio: add support for E+H FXA291 - USB: serial: option: add TDTECH MT5710-CN - crypto: rsa-pkcs1pad: Don't WARN on an empty digest - usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits - ASoC: bt-sco: fix bt-sco-pcm-wb dai widget don't connect to the endpoint - ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI - wifi: mac80211: recalculate TIM when a station enters power save - amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - net: bridge: vlan: add support for global options - net: bridge: vlan: add support for dumping global vlan options - net: bridge: vlan: fix vlan range dumps starting with pvid - net: stmmac: reset residual action in L3L4 filters on delete - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup - hinic: remove unused ethtool RSS user configuration buffers - net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule - net/mlx5e: Report zero bandwidth for non-ETS traffic classes - net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation - raw: use more conventional iterators - drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() - drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() - drm/radeon: fix r100_copy_blit for large BOs - net: ipv6: fix dif and sdif mismatch in raw6_icmp_error - drm/amdgpu: Fix VFCT bus number matching with soft filter - drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) - media: cec: seco: unregister adapter on IR probe failure - media: cedrus: clean up media device on probe failure - media: cedrus: Fix missing cleanup in error path - media: tegra-video: vi: fix invalid u32 return value in format lookup - media: vb2: use ssize_t for vb2_read/vb2_write - media: vidtv: fix reference leak on failed device registration - media: vimc: fix reference leak on failed device registration - tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() - arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates - Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" - iommu/vt-d: Disallow SVA if page walk is not coherent - raw: remove unused variables from raw6_icmp_error() - raw: fix a typo in raw_icmp_error() - net: bridge: vlan: fix global vlan option range dumping - media: uvcvideo: Implement dual stream quirk to fix loss of usb packets - media: uvcvideo: Fix sequence number when no EOF - HID: logitech-dj: Standardise hid_report_enum variable nomenclature - HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write - HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA - ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup - ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup - assoc_array: trim the final shortcut word using the current chunk end - smb: client: fix buffer leaks in SMB1 read and write - hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks - hwmon: (adt7470) Create functions for updating readings and limits - hwmon: (adt7470) Fix some style issues - hwmon: (adt7470) Convert to use regmap - hwmon: (adt7470) Fix PWM auto temp state array and bounds check - powerpc/boot: Fix simpleboot CPU node lookup check - powerpc/boot: Fix treeboot-currituck CPU node lookup check - powerpc/boot: Fix treeboot-akebono CPU node lookup check - hwmon: (pmbus) Fix return value from pmbus_update_byte_data() - net: phylink: put link_gpio if phylink_create fails - scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req - net: sxgbe: check descriptor ring allocation failures - can: isotp: check register_netdevice_notifier() error in module init - tracing/mmiotrace: Reset dropped_count in mmio_reset_data() - octeontx2-pf: Set correct sequence for carrier off and tx queue stop - pinctrl: bm1880: add missing select GENERIC_PINCONF - audit: fix potential integer overflow in audit_log_n_string() - bpf: lwt: Fix dst reference leak on reroute failure - ALSA: lx6464es: fix period byte count for 16-bit streams - ASoC: tas2562: fix DVC coefficient write order - ASoC: tas2562: fix broken entries in the volume lookup table - dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+ - e1000: fix memory leak in e1000_probe() - powerpc/ps3: Fix map failure path in dma_ioc0_map_pages() - vxlan: unclone skb head before modifying eth header in route_shortcircuit() - tracing/filters: Fix false positive match in regex_match_full() - selftests/clone3: fix wild pointer access of getline due to missing init - sctp: reject stale cookies with mismatched verification tags - cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init() - phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask - phy: zynqmp: use read-modify-write for SERDES scrambler bypass - phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB - can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams() - drm/amdgpu: cap GTT size to physical RAM on APUs - net: openvswitch: fix skb leak on flow key update failure during recirculation - mount: honour SB_NOUSER in the new mount API - nfs4: take a reference on the nfs_client when running FREE_STATEID - ARM: npcm: Fix OF node refcount leaks in SMP setup - net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete - net/mlx5: Remove second FW tracer check - counter: microchip-tcb-capture: Fix DT channel validation - net: openvswitch: Fix kerneldoc warnings - net: openvswitch: fix kernel-doc warnings in flow.c - bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips - sctp: fix addip_serial increment on ASCONF_ACK allocation failure - net: marvell: prestera: try to load previous fw version - sctp: remove the unessessary hold for idev in sctp_v6_err - sctp: extract sctp_v6_err_handle function from sctp_v6_err - sctp: extract sctp_v4_err_handle function from sctp_v4_err - tls: don't abort the connection on signal-interrupted sends - spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers - ALSA: usb-audio: Evaluate packsize caps at the right place - ipvs: add totalconns for dest - ipvs: properly update the overload flag on dest edit - fscrypt: Replace mk_users keyring with simple list - misc: fastrpc: fix channel ctx ref leak when session alloc fails - misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free - scsi: scsi_debug: Negate wrapped memcmp() result - prestera: fix fallback to previous version on same major version - hwmon: (adt7470) Add missing dependency on REGMAP_I2C - hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors - Linux 5.10.265 - ipvs: separate destination availability state - selinux: require every boolean value to be defined - ASoC: cs4265: sort the register default table - powerpc/pseries: pci - logic bug - Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard - powerpc/pseries: lparcfg - fix kbuf[] underflow - ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() - Input: sur40 - fix V4L error path cleanup - ceph: fix MDS random selection readiness predicate - mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit - mmc: sdhci: unmap the bounce buffer before device release - mmc: sdhci: make tuning_err a signed int - drm/radeon: fix autosuspend cleanup during teardown - drm/amdgpu: Reject UVD message with invalid number of h265 refs - drm/amdgpu: Reject UVD message with dimensions above 4096 - drm/amdgpu: Implement insert_end for VCE 3 - xfs: check v5 superblock features early - udmabuf: Do not create malformed scatterlists - i2c: davinci: Unregister cpufreq notifier on probe failure - device property: Add fwnode_irq_get_byname - i2c: smbus: Use device_*() functions instead of of_*() - VFS/audit: introduce kern_path_parent() for audit - audit: widen ino fields to u64 - audit: use 'unsigned int' instead of 'unsigned' - ALSA: hda: Fix cached processing coefficient verbs - serial: max310x: replace bare use of 'unsigned' with 'unsigned int' (checkpatch) - serial: max310x: implement gpio_chip::get_direction() - rxrpc: Fix notification vs call-release vs recvmsg - rxrpc: Fix socket notification race - mlxsw: spectrum: Apply RIF configuration when joining a LAG - mlxsw: spectrum: On port enslavement to a LAG, join upper's bridges - octeontx2: Annotate mmio regions as __iomem - octeontx2-pf: clear stale mailbox IRQ state before request_irq() - ASoC: mediatek: mt8183: Check runtime resume during probe - octeontx2-vf: clear stale mailbox IRQ state before request_irq() - netfilter: nf_conntrack_sip: remove net variable shadowing - jbd2: add a helper to find out number of fast commit blocks - lsm: use default hook return value in call_int_hook() - lsm: infrastructure management of the sock security - taskstats: fill_stats_for_tgid: use for_each_thread() - taskstats: retain dead thread stats in TGID queries - mtd: spi-nor: sst: remove global protection flag - mtd: spi-nor: intel: remove global protection flag - mtd: spi-nor: Move Software Write Protection logic out of the core - mtd: spi-nor: Fix spi_nor_try_unlock_all() - smb: client: use kvzalloc() for megabyte buffer in simple fallocate - PCI: Add pci_find_vsec_capability() to find a specific VSEC - dmaengine: dw-edma: Improve the linked list and data blocks definition - dmaengine: dw-edma: Remove unused irq field in struct dw_edma_chip - i2c: imx: separate atomic, dma and non-dma use case - thunderbolt: Keep XDomain reference during the lifetime of a service - thunderbolt: Remove XDomain from the bus without holding tb->lock - ovl: use linked upper dentry in copy-up tmpfile - scsi: target: core: pr: Initialize arrays at declaration time - scsi: target: core: Generate correct identifiers for PR OUT transport IDs - mmc: vub300: rename probe error labels - firmware_loader: introduce __free() cleanup hanler - net: Add helper function to parse netlink msg of ip_tunnel_encap - net/sched: taprio: avoid calling child->ops->dequeue(child) twice - bootconfig: do not put quotes on cmdline items unless necessary - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c - bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline() - net: ipa: fix SMEM state handle leaks in SMP2P init - usb: gadget: bdc: fix checkpatch.pl spacing error - USB: serial: keyspan_pda: refactor write-room handling - USB: serial: keyspan_pda: fix write implementation - USB: serial: keyspan_pda: add write-fifo support - USB: serial: keyspan_pda: clean up comments and whitespace - USB: serial: keyspan_pda: fix data loss on receive throttling - KVM: x86: Drop @vcpu parameter from kvm_x86_ops.hwapic_isr_update() - KVM: x86: Check for in-kernel xAPIC when querying APICv for directed yield - KVM: x86: Move "apicv_active" into "struct kvm_lapic" - KVM: Introduce vcpu->wants_to_run - KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN - dma-buf/drivers: make reserving a shared slot mandatory v4 - drm/virtio: use uninterruptible resv lock for plane updates - drm/displayid: fix Tiled Display Topology ID size - drm/tegra: fbdev: Remove offset into framebuffer memory - drm/virtio: Return proper error codes instead of -1 - media: aspeed: fix missing of_reserved_mem_device_release() on probe failure - drm/i915/hdcp: require monotonically increasing seq_num_v - media: marvell-cam: fix missing pci_disable_device() on remove - media: i2c: imx219: Drop IMX219_VTS_* macros - media: i2c: imx219: Correct the minimum vblanking value - media: i2c: imx219: Rename VTS to FRM_LENGTH - media: imx219: Fix maximum frame length in lines - media: v4l: async: Set owner for async sub-devices - serial: 8250_mid: Remove unneeded test for ->setup() presence - mptcp: only set DATA_FIN when a mapping is present - sc16is7xx: Properly resume TX after stop - serial: sc16is7xx: Fill in rs485_supported - serial: sc16is7xx: remove obsolete out_thread label - serial: sc16is7xx: fix regression with GPIO configuration - serial: sc16is7xx: implement gpio get_direction() callback - mptcp: fix subflow accounting on close - mptcp: decrement subflows counter on failed passive join - libceph: Amend checking to fix `make W=1` build breakage - libceph: add doutc and *_client debug macros support - ceph: rename _to_client() to _to_fs_client() - skbuff: introduce skb_pull_data - mm/vmstat: fold stranded per-cpu node stats when a node comes online - net: pktgen: fix code style (WARNING: Block comments) - scsi: sd: sd_zbc: Improve source code documentation - scsi: sd: sd_zbc: Use logical blocks as unit when querying zones - scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() - scsi: scsi_debug: Rename zone type constants - ice: fix VF interrupts cleanup - ice: fix memory leak in ice_lbtest_prepare_rings() - i2c: bcm-iproc: remove printout on handled timeouts - i2c: iproc: reset bus after timeout if START_BUSY is stuck - fsnotify: opt-in for permission events at file open time - fs: don't block write during exec on pre-content watched files - can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure - hwmon: (npcm750-pwm-fan): stop fan timer on device detach - drm/amd/pm: fix torn gpu metrics reads - ALSA: usx2y: Fix potential leaks of uninitialized memory - arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 - crypto: ccm - Set rfc4309 maxauthsize from child - netfilter: ipset: fix list type element drift bug - net: packet: fix wrong transport_header when sending VLAN-tagged frame - net: ethernet: ti: am65-cpsw: move ale selection in pdata - net: ethernet: ti: am65-cpsw: move free desc queue mode selection in pdata - net: ethernet: ti: am65-cpsw: add multi port support in mac-only mode - net/smc: rdma write inline if qp has sufficient inline space - i2c: smbus: Check for parent device before dereference - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() - ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() - Linux 5.10.266 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept - rndis_host: add overflow check in rndis_rx_fixup() - ocfs2: fix missing metadata reservation for large xattrs - ext4: stop retrying saturated xattr cache entries - ext4: clear error before retrying inode xattr space fallback - xfs: validate attr entry pointer before field access - misc: fastrpc: separate fastrpc device from channel context - misc: fastrpc: Rework fastrpc_req_munmap - net: ipv4: Publish fib_nlmsg_size() - perf: Fix cgroup state vs ERROR - perf: Fix dangling cgroup pointer in cpuctx - KVM: arm64: Retry fault if vma_lookup() results become invalid - nfc: digital: clamp SENSF_RES length to the destination buffer - nfc: fdp: bound the device-reported read length and fix an skb leak - nfc: microread: validate target discovery payload lengths - nfc: llcp: bound the connect_sn TLV walk to the skb - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers - nfc: llcp: reject PDUs shorter than the LLCP header - nfc: pn533: purge fragmented skbs during cleanup - nfc: st21nfca: validate ATR_REQ length against the received frame - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() - nfc: nci: free destination parameters when closing a connection - ipv4: reject undersized MTUs in ip_do_fragment() - ipv6: fix use-after-free in ip6_finish_output2() - nvmet-fc: fix invalid free in LS IOD error path - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations - HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID - HID: core: fix OOB read of field->usage in hid_set_field() - Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" - can: use skb hash instead of private variable in headroom - HID: core: fix number/pointer type confusion on long items - HID: sensor: custom: Fix use-after-free in enable_sensor - HID: hyperv: validate initial device info bounds - Revert "ALSA: aoa: Use guard() for mutex locks" - Linux 5.10.267 - Linux 5.10.268 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() - ext4: don't enable DAX on new encrypted files - io_uring/io-wq: fix worker accounting when canceling creation callbacks - Revert "PM: sleep: Use complete() in device_pm_sleep_init()" - selinux: switch two allocations to use kzalloc_objs() - Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup" - Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate" - kcov: fix data corruption and race conditions on PREEMPT_RT - ext4: propagate errors from fast commit range replay - nilfs2: reject invalid block index in GC ioctl - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers - HID: magicmouse: do not keep a stale msc->input if no input is claimed - nfc: nci: add data_len bound checks to activation parameter extractors - nvmet-tcp: bound SGL data length before allocating command buffers - HID: input: read battery capacity from its actual report offset - fpga: dfl: fme: add error handling - accessibility: speakup: unregister tty ldisc on later init failures - usb: usbtest: disable dynamic ID support - usb: gadget: f_tcm: keep port count until LUN teardown completes - xfrm: espintcp: fix UAF during close - xfrm: drop ESP-in-TCP packets with no ingress device - xfrm: ah6: validate routing header segments_left - xfrm: fix xfrm_state_construct() auth-trunc leak - ipv6: seg6: clear IPv4 control block on IPIP decapsulation - mm/swap: reject swapon() on filesystem-level encrypted files - crypto: atmel-tdes - use scatterlist length before DMA mapping - crypto: mxs-dcp - fix source scatterlist length access - KVM: s390: vsie: zero stale crypto bits - usb: core: Add lock to usb_wakeup_notification() - usb: core: Strengthen error handling in hub_hub_status() - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() - USB: serial: option: fix slab OOB read in interrupt URB callback - USB: serial: spcp8x5: drop broken carrier detect support - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() - usb: usbfs: fix use-after-free of usb_device in usbdev_release() - Linux 5.10.269

0 tuxcare-debian11-els bpftool_5.10.269-1+tuxcare.els1_amd64.deb da45814f6b031bb1967bc284722acc480f07e10c hyperv-daemons_5.10.269-1+tuxcare.els1_amd64.deb cb8daea603cac600cd7a67704b3d38ef469845ee libcpupower-dev_5.10.269-1+tuxcare.els1_amd64.deb cc14089fe361b182ae0e567dfe1ebe2e0aacb845 libcpupower1_5.10.269-1+tuxcare.els1_amd64.deb 53ae38c545abdaa234d0b8529f62ffc53295c69c linux-compiler-gcc-10-x86_5.10.269-1+tuxcare.els1_amd64.deb 36479cc76935305f1d07f6e19dc3873055df2f30 linux-config-5.10_5.10.269-1+tuxcare.els1_amd64.deb e70c3cb8e3fc0d246ead4df7ada0b7c0030d1688 linux-cpupower_5.10.269-1+tuxcare.els1_amd64.deb 602be2f21f294f045747e385e29fecfd85caa1d1 linux-doc_5.10.269-1+tuxcare.els1_all.deb cc3262de6051ed92489661f3a57157d7e1fd3c47 linux-doc-5.10_5.10.269-1+tuxcare.els1_all.deb e114219f35c18817141162c0059d6d5e4d9441d9 linux-headers-5.10.0-48-amd64_5.10.269-1+tuxcare.els1_amd64.deb 84a3bd44ff599adc4135957f4f685f7b08377a2c linux-headers-5.10.0-48-common_5.10.269-1+tuxcare.els1_all.deb 0f8304b3bb92d7955a5208b9dcf543ca9f568d80 linux-headers-amd64_5.10.269-1+tuxcare.els1_amd64.deb 46481d5dc3eb0616fe50287027ea375fa73f0283 linux-image-5.10.0-48-amd64-unsigned_5.10.269-1+tuxcare.els1_amd64.deb 86d5568de556d21e3d05f5219f75cce38685bdfc linux-image-amd64_5.10.269-1+tuxcare.els1_amd64.deb 2a78d3999da017209cac03eca11f2b162d489ef1 linux-image-amd64-signed-template_5.10.269-1+tuxcare.els1_amd64.deb b9b1a4899bea81a03b50e9331def51b4af7d9ceb linux-kbuild-5.10_5.10.269-1+tuxcare.els1_amd64.deb 48f70df27a7c9d98efebca3c741fbf7d5bcb5e12 linux-libc-dev_5.10.269-1+tuxcare.els1_amd64.deb 343599f1b0d62d47fcefbe198c4c65e3adefbf75 linux-perf_5.10.269-1+tuxcare.els1_amd64.deb 7760f9774ed14c29105e8313e806415ab2ce632c linux-perf-5.10_5.10.269-1+tuxcare.els1_amd64.deb 0979a1ef1a6e2eef32c7d6750b2e2691d80be65e linux-source_5.10.269-1+tuxcare.els1_all.deb 0a616f913662937234dc3f91670a51153abc9645 linux-source-5.10_5.10.269-1+tuxcare.els1_all.deb 08f07e4b5d150abfa3e72a43f11060d9b7d776ff linux-support-5.10.0-48_5.10.269-1+tuxcare.els1_all.deb 2b9c10b495929ba97776264989151e19adaf471a bpftool_5.10.269-1+tuxcare.els1_arm64.deb 8b3e61342ea49ef651ecfaee3ba91843809b046b hyperv-daemons_5.10.269-1+tuxcare.els1_arm64.deb e32466a24cef2bbdc43bc53ee067093cf4cc8eba libcpupower-dev_5.10.269-1+tuxcare.els1_arm64.deb 67ce0ebe966e0d6c9a2cb094aa7aaa34eee6acc2 libcpupower1_5.10.269-1+tuxcare.els1_arm64.deb 4e3718c09f3f6b508d585b9ee692e5f34519005f linux-config-5.10_5.10.269-1+tuxcare.els1_arm64.deb 926810da439e58e82f964082c29103b3d413583d linux-cpupower_5.10.269-1+tuxcare.els1_arm64.deb 06db85466b2c82034db1fdfaea078a80d7d0aae9 linux-headers-5.10.0-48-arm64_5.10.269-1+tuxcare.els1_arm64.deb ed6afd41d731de1e2cf96a6ee1bcb2ac23d56e46 linux-headers-arm64_5.10.269-1+tuxcare.els1_arm64.deb 80a27003c5cdad86764d7885687bdbdab1d04fbd linux-image-5.10.0-48-arm64-unsigned_5.10.269-1+tuxcare.els1_arm64.deb b548aa8d20d598e815ed7127414e9af4261fdb60 linux-image-arm64_5.10.269-1+tuxcare.els1_arm64.deb a01849f47d63a7f3f27b762b9b2d8777f38ba0ef linux-image-arm64-signed-template_5.10.269-1+tuxcare.els1_arm64.deb 1c2d497a15f94a37798005e6facb1194d6c60dda linux-kbuild-5.10_5.10.269-1+tuxcare.els1_arm64.deb 68e93b722922e2e2788eeac23b37c7f444fd1030 linux-libc-dev_5.10.269-1+tuxcare.els1_arm64.deb a743a1a915ab51824d96f5738e7c77d9df0dd658 linux-perf_5.10.269-1+tuxcare.els1_arm64.deb 7f8a5311a212b824e0e11e6982bfdfb5136bd362 linux-perf-5.10_5.10.269-1+tuxcare.els1_arm64.deb fb579a15dcdc621799398ed78aa24000ac8d8c05 bpftool_5.10.269-1+tuxcare.els1_armel.deb 5f1cbb645e0f31651bf91764be14c17a4806f2a2 libcpupower-dev_5.10.269-1+tuxcare.els1_armel.deb da0bc7e2f9335f8cbd9ce292e6f8a45de1073408 libcpupower1_5.10.269-1+tuxcare.els1_armel.deb 00d3b9099b51719727db641d583bf946a08ac58a linux-compiler-gcc-10-arm_5.10.269-1+tuxcare.els1_armel.deb ff148165d57dd177686f80c24e4696350e424d8d linux-config-5.10_5.10.269-1+tuxcare.els1_armel.deb 028383478fdacac8320ef8623e3c6361d5b5a0df linux-cpupower_5.10.269-1+tuxcare.els1_armel.deb ec8dc10367c9a108493a7ba5f05ac324bf5a93f9 linux-headers-5.10.0-48-marvell_5.10.269-1+tuxcare.els1_armel.deb 96097e0c7a5139f8959d83684c718d96eff7c0c4 linux-headers-5.10.0-48-rpi_5.10.269-1+tuxcare.els1_armel.deb a348709fe7952e8ff484b676ef2684b566d4425a linux-headers-marvell_5.10.269-1+tuxcare.els1_armel.deb 7e375a1acc242637d38afaca9838516fc95ef204 linux-headers-rpi_5.10.269-1+tuxcare.els1_armel.deb 94a54ade63927523e9a7ec33e24bc1a109ad295a linux-image-5.10.0-48-marvell_5.10.269-1+tuxcare.els1_armel.deb 894bc9e90b17053abaaae64ae4558a74988cb678 linux-image-5.10.0-48-rpi_5.10.269-1+tuxcare.els1_armel.deb 2eae4df818fe210596c7ddeda47397cb55972788 linux-image-marvell_5.10.269-1+tuxcare.els1_armel.deb cdfc761e04b4a42cf1e836a9e55b17b4f935712c linux-image-rpi_5.10.269-1+tuxcare.els1_armel.deb 58d006c4a10fe30b955128171b6e4db5a5b72e01 linux-kbuild-5.10_5.10.269-1+tuxcare.els1_armel.deb 45d4b4db7fc6489ded6ea8638e124d2eb5052388 linux-libc-dev_5.10.269-1+tuxcare.els1_armel.deb c16d68c91d47513334676eeb01c45698de43de97 linux-perf_5.10.269-1+tuxcare.els1_armel.deb b4a255f884102955d7c0f362d3e49e65bf086916 linux-perf-5.10_5.10.269-1+tuxcare.els1_armel.deb 9226cd211518a5997e525da10e60286100dfc1cc CLSA-2026:1787918353 TuxCare License Agreement 0 * TuxCare ELS build of the Debian 11 (bullseye) 5.10.262 kernel (x86_64/aarch64/armel). * Reconstructed on the newer bullseye-security 5.10.262-1 base (rolls up upstream stable 5.10.260 / .261 / .262), replacing the prior 5.10.259-1 base. Debian patch set re-imported as git commits (ip6_vti patch dropped — now upstream; firmware log-message patch refreshed). * Single-source: embed the linux-latest + linux-signed meta packages into the source tree (debian/meta/) so one dpkg-buildpackage run produces the versioned kernel AND the meta/signed packages. * ABI: this ELS changelog entry increments the gencontrol-computed abiname 5.10.0-46 -> 5.10.0-47, so the ELS kernel ships as linux-image-5.10.0-47-*, a distinct, co-installable package vs Debian stock 5.10.0-46. * Disable the rt and cloud featuresets/flavours (not shipped by ELS). * Fix the duplicate pinned image/headers meta on signed arches under disable-signed: gate the pinned-meta emission on raw signed-code so only the embed's fallback meta (linux-image-5.10.0-47-amd64 | ...-unsigned) ships. * Backport security fixes for potentially-exploited (KCARE 0/1-day) CVEs: CVE-2026-46113 (KVM x86 shadow-paging UAF, unexpected GFN/role), CVE-2026-64561 (KVM x86: check obsolete root after making MMU pages available), CVE-2026-64564 (SCTP ASCONF DEL-IP transport use-after-free), CVE-2026-64600 (XFS: resample data-fork mapping after cycling ILOCK). * Drop the prior CVE-2026-43499 (rtmutex remove_waiter UAF) and CVE-2026-46331 (net/sched pedit partial-COW) backports — both are included upstream in the 5.10.260 / .261 / .262 stable roll-up. Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* TuxCare ELS build of the Debian 11 (bullseye) 5.10.262 kernel (x86_64/aarch64/armel). * Reconstructed on the newer bullseye-security 5.10.262-1 base (rolls up upstream stable 5.10.260 / .261 / .262), replacing the prior 5.10.259-1 base. Debian patch set re-imported as git commits (ip6_vti patch dropped — now upstream; firmware log-message patch refreshed). * Single-source: embed the linux-latest + linux-signed meta packages into the source tree (debian/meta/) so one dpkg-buildpackage run produces the versioned kernel AND the meta/signed packages. * ABI: this ELS changelog entry increments the gencontrol-computed abiname 5.10.0-46 -> 5.10.0-47, so the ELS kernel ships as linux-image-5.10.0-47-*, a distinct, co-installable package vs Debian stock 5.10.0-46. * Disable the rt and cloud featuresets/flavours (not shipped by ELS). * Fix the duplicate pinned image/headers meta on signed arches under disable-signed: gate the pinned-meta emission on raw signed-code so only the embed's fallback meta (linux-image-5.10.0-47-amd64 | ...-unsigned) ships. * Backport security fixes for potentially-exploited (KCARE 0/1-day) CVEs: CVE-2026-46113 (KVM x86 shadow-paging UAF, unexpected GFN/role), CVE-2026-64561 (KVM x86: check obsolete root after making MMU pages available), CVE-2026-64564 (SCTP ASCONF DEL-IP transport use-after-free), CVE-2026-64600 (XFS: resample data-fork mapping after cycling ILOCK). * Drop the prior CVE-2026-43499 (rtmutex remove_waiter UAF) and CVE-2026-46331 (net/sched pedit partial-COW) backports — both are included upstream in the 5.10.260 / .261 / .262 stable roll-up.

0 tuxcare-debian11-els bpftool_5.10.262-1+tuxcare.els1_amd64.deb 4d7facb157112048413c6af1e474fa52cadf0b57 hyperv-daemons_5.10.262-1+tuxcare.els1_amd64.deb f98d9a3491fc58b718df617048efa02a6dd12715 libcpupower-dev_5.10.262-1+tuxcare.els1_amd64.deb 720efaa7d433c0c19739c0f91f60ef5b73881168 libcpupower1_5.10.262-1+tuxcare.els1_amd64.deb 3dfbd49739ffdc1d6505dd868f48c52e78b3f65e linux-compiler-gcc-10-x86_5.10.262-1+tuxcare.els1_amd64.deb 3007d4a0f59d27f972570761e95b5e1058869be4 linux-config-5.10_5.10.262-1+tuxcare.els1_amd64.deb 84367decf735c421b0375ef8abc184d7d5dfdd90 linux-cpupower_5.10.262-1+tuxcare.els1_amd64.deb 3c3a7fe08981094ae49e3bbbf481c9122b634c72 linux-doc_5.10.262-1+tuxcare.els1_all.deb 6aaa3709f273c1f92e81eb57a7b443ec97e4ee0e linux-doc-5.10_5.10.262-1+tuxcare.els1_all.deb d7e82ac28c413e9b8fe434fa8f69e112570a3fe9 linux-headers-5.10.0-47-amd64_5.10.262-1+tuxcare.els1_amd64.deb 1018cd26dfc2ab7b866355dd1d9f7e7037584266 linux-headers-5.10.0-47-common_5.10.262-1+tuxcare.els1_all.deb 1d9ef2741366c703de6c96b52a9ae778771bfd57 linux-headers-amd64_5.10.262-1+tuxcare.els1_amd64.deb b88aa3f3ae66955b69dee2820b52e3409f8c7c7d linux-image-5.10.0-47-amd64-unsigned_5.10.262-1+tuxcare.els1_amd64.deb 7f5ed4fd0053e889de9f84f11e5b806c60a18666 linux-image-amd64_5.10.262-1+tuxcare.els1_amd64.deb e30c84decc14eef60b90a519550904e31c745dfa linux-image-amd64-signed-template_5.10.262-1+tuxcare.els1_amd64.deb 8237b25a27b7155b624fda43c7e8aa5b8a4b28fd linux-kbuild-5.10_5.10.262-1+tuxcare.els1_amd64.deb 4e645327845cacb33d12638762650cf870adcf8d linux-libc-dev_5.10.262-1+tuxcare.els1_amd64.deb 512b2e0f938b3fc87724655285ee244cc9a68de0 linux-perf_5.10.262-1+tuxcare.els1_amd64.deb 325e5fc4ffcbc3081e5c95b334b360d42da63d5d linux-perf-5.10_5.10.262-1+tuxcare.els1_amd64.deb 22d320de0473e9f787fc19c618c1b3604cada40f linux-source_5.10.262-1+tuxcare.els1_all.deb 03f847b48ae56bf588066a42f705a2e9dbf44271 linux-source-5.10_5.10.262-1+tuxcare.els1_all.deb 516825fb1e12eadc37ee122b0e34d8eccb4db059 linux-support-5.10.0-47_5.10.262-1+tuxcare.els1_all.deb 965079f47e09f13fd9c0369adb829a084d902d38 bpftool_5.10.262-1+tuxcare.els1_arm64.deb 03270aa88d76ad2e356d5c3ce500b1088c8dab93 hyperv-daemons_5.10.262-1+tuxcare.els1_arm64.deb 366a6207a28e940dc59349e976e73c867e306320 libcpupower-dev_5.10.262-1+tuxcare.els1_arm64.deb d9defde5ba8ee88c4165cdd0973935d320b2ce68 libcpupower1_5.10.262-1+tuxcare.els1_arm64.deb a033c09c7298466271083f0a85a9e2df25056605 linux-config-5.10_5.10.262-1+tuxcare.els1_arm64.deb 1e8c1a803bbec1c9d500387f3b8111db23fa56a9 linux-cpupower_5.10.262-1+tuxcare.els1_arm64.deb 5b6ecd3b93232e45344f8d4afe0dc68bcd32b5af linux-headers-5.10.0-47-arm64_5.10.262-1+tuxcare.els1_arm64.deb 222310ac127ae61e8be6d991f96a437f06e56601 linux-headers-arm64_5.10.262-1+tuxcare.els1_arm64.deb 10178d7e31e33bcb8dc0126bb0eb037f0acfec9f linux-image-5.10.0-47-arm64-unsigned_5.10.262-1+tuxcare.els1_arm64.deb e4a606772df02b0ed8c641079bc392b4691da13e linux-image-arm64_5.10.262-1+tuxcare.els1_arm64.deb d138d724e1c36395ea1f688b0ead48a544bb535c linux-image-arm64-signed-template_5.10.262-1+tuxcare.els1_arm64.deb ecd43bdc50f39a67b5089c02e903c27dc0663d9e linux-kbuild-5.10_5.10.262-1+tuxcare.els1_arm64.deb 4edf19dd35c853322083ea3997ae70883622edc4 linux-libc-dev_5.10.262-1+tuxcare.els1_arm64.deb 1b9dbbabcd8788932e96541991ccbb102a657221 linux-perf_5.10.262-1+tuxcare.els1_arm64.deb 8bd012a75749a99068f5e2e4bff5d4d58743529c linux-perf-5.10_5.10.262-1+tuxcare.els1_arm64.deb 8a288edd675ad849a23c3cfe333d018672d8fb82 bpftool_5.10.262-1+tuxcare.els1_armel.deb 4a1acab2c122dd4943c9525657c7ad962ccf8615 libcpupower-dev_5.10.262-1+tuxcare.els1_armel.deb 0f5dd064be1b37cd5fd0788759abdf1a6b0cd743 libcpupower1_5.10.262-1+tuxcare.els1_armel.deb 1eb2361debdcc99d17c2ba9f48bedbe2a0fdcabc linux-compiler-gcc-10-arm_5.10.262-1+tuxcare.els1_armel.deb 79342968b67af45d014c7c1d66eb06cda0ee45e7 linux-config-5.10_5.10.262-1+tuxcare.els1_armel.deb 83e23df0ae8052def0b0e3e2f334fe29f9e08305 linux-cpupower_5.10.262-1+tuxcare.els1_armel.deb 76a1651f19dac9756bf110f79317f9f4e2016fc2 linux-headers-5.10.0-47-marvell_5.10.262-1+tuxcare.els1_armel.deb e198b379a5f2d391afa846d219168b33cec47dbc linux-headers-5.10.0-47-rpi_5.10.262-1+tuxcare.els1_armel.deb 7dc4b08666b5f8042d558d90169e7ae303015d89 linux-headers-marvell_5.10.262-1+tuxcare.els1_armel.deb 618315f338adf3085ce96091ac0c92e0bf6dff25 linux-headers-rpi_5.10.262-1+tuxcare.els1_armel.deb ba0ad331b8281767bd7e372a5200209a86bef305 linux-image-5.10.0-47-marvell_5.10.262-1+tuxcare.els1_armel.deb c34cda47bcf68f4011204abbdda0bdad51480878 linux-image-5.10.0-47-rpi_5.10.262-1+tuxcare.els1_armel.deb 71bb3363af2c7d9074d6639a27ca12b290cd0e07 linux-image-marvell_5.10.262-1+tuxcare.els1_armel.deb f792fe723cb0efa2b4323966e0c2e552535dc7f6 linux-image-rpi_5.10.262-1+tuxcare.els1_armel.deb aa9fb819920b4a9fc2a5d249b0fd129871c36a5c linux-kbuild-5.10_5.10.262-1+tuxcare.els1_armel.deb ed3d326d51ca98a2f222bc2b4d7067d88336d915 linux-libc-dev_5.10.262-1+tuxcare.els1_armel.deb f5d7d3940723be616c1d7f85e90ad20b9525d1c5 linux-perf_5.10.262-1+tuxcare.els1_armel.deb 685eefb6e05cc8a5e084e984929005e26fc52e15 linux-perf-5.10_5.10.262-1+tuxcare.els1_armel.deb 12f76801fba95e25de05d0e3d2ec9ce1b5e77922 CLSA-2026:1789978950 TuxCare License Agreement 0 * Update to upstream stable Linux 5.10.270 (from 5.10.269). * Bump kernel ABI to 49: ship the ELS kernel as 5.10.0-49-*, distinct from the prior 5.10.0-48. * CVE-2022-48650 - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650} * CVE-2023-52676 - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676} * CVE-2023-54237 - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() {CVE-2023-54237} * CVE-2024-41062 - bluetooth/l2cap: sync sock recv cb and release {CVE-2024-41062} * CVE-2025-21651 - net: hns3: don't auto enable misc vector {CVE-2025-21651} * CVE-2025-22103 - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103} * CVE-2025-38097 - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097} * CVE-2025-40123 - bpf: Enforce expected_attach_type for tailcall compatibility {CVE-2025-40123} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2026-31420 - bridge: mrp: reject zero test interval to avoid OOM panic {CVE-2026-31420} * CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2026-46158 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount {CVE-2026-46158} * CVE-2026-46170 - mptcp: pm: ADD_ADDR rtx: free sk if last {CVE-2026-46170} * CVE-2026-53078 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} * CVE-2026-72255 - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} * CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} * CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe {CVE-2026-74378} * CVE-2026-74565 - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} * CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON {CVE-2026-80671} * CVE-2026-80689 - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions {CVE-2026-80689} * CVE-2026-80888 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import {CVE-2026-80888} * CVE-2026-80912 - selinux: reject an unclaimed class value in security_get_classes() {CVE-2026-80912} * CVE-2026-80930 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout {CVE-2026-80930} * CVE-2026-80931 - w1: ds28e17: reject an oversize length on an I2C block read {CVE-2026-80931} * CVE-2026-80932 - vsock/virtio: flush works in dependency order {CVE-2026-80932} * CVE-2026-80941 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() {CVE-2026-80941} * CVE-2026-80944 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait {CVE-2026-80944} * CVE-2026-80949 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949} * CVE-2026-80952 - i3c: master: Fix info leak and UAF in device unregister path {CVE-2026-80952} * CVE-2026-80963 - dm-stats: fix a crash if allocation of per-cpu data fails {CVE-2026-80963} * CVE-2026-80965 - ALSA: serial-u16550: Check card index validity at probe {CVE-2026-80965} * CVE-2026-80966 - ALSA: portman2x4: Check card index validity at probe {CVE-2026-80966} * CVE-2026-80968 - ALSA: mts64: Check card index validity at probe {CVE-2026-80968} * CVE-2026-80969 - ALSA: mpu401: Check card index validity at probe {CVE-2026-80969} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-80973 - ALSA: 6fire: bound the MIDI event length from the device {CVE-2026-80973} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-80977 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977} * CVE-2026-80978 - net: cap advertised IP tunnel headroom {CVE-2026-80978} * CVE-2026-80987 - NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987} * CVE-2026-80988 - NTB: ntb_transport: Fail TX enqueue when the QP link is down {CVE-2026-80988} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-81002 - xdp: fix zero-copy frame layout {CVE-2026-81002} * CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} * CVE-2026-81005 - ipmi: si: Fix NULL pointer dereference after failed registration {CVE-2026-81005} * CVE-2026-81007 - ipmi: ipmb: validate write message length {CVE-2026-81007} * CVE-2026-81008 - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() {CVE-2026-81008} * CVE-2026-81017 - platform/chrome: sensorhub: Bound the EC-reported sensor number {CVE-2026-81017} * CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure {CVE-2026-89440} * CVE-2026-89456 - s390/dasd: Propagate partial completion length across ERP recovery {CVE-2026-89456} * CVE-2026-89457 - s390/dasd: Guard sysfs discipline callbacks against unallocated private data {CVE-2026-89457} * CVE-2026-89458 - s390/dasd: Do not complete a failed ESE read as successful {CVE-2026-89458} * CVE-2026-89461 - power: supply: max17040: synchronize work cancellation on suspend {CVE-2026-89461} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-89470 - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS {CVE-2026-89470} * CVE-2026-89471 - power: supply: cros_usbpd-charger: bound the EC-reported port count {CVE-2026-89471} * CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-89479 - sctp: stop processing a packet once its association is deleted {CVE-2026-89479} * CVE-2026-89482 - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482} * CVE-2026-89483 - nvme: zero the discard fallback page {CVE-2026-89483} * CVE-2026-89485 - lockd: pin next file across nlm_inspect_file lock-drop {CVE-2026-89485} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} * CVE-2026-89489 - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall {CVE-2026-89489} * CVE-2026-89490 - ocfs2: fix readdir position truncation on 32-bit kernels {CVE-2026-89490} * CVE-2026-89491 - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() {CVE-2026-89491} * CVE-2026-89493 - ocfs2: validate rl_used against rl_count in refcount block validator {CVE-2026-89493} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89496 - ocfs2: always run deallocs on copy-on-write completion {CVE-2026-89496} * CVE-2026-89497 - orangefs: skip leading spaces before parsing client debug masks {CVE-2026-89497} * CVE-2026-89498 - orangefs: fix double-free of trailer_buf on readdir copy failure {CVE-2026-89498} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-89508 - RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508} * CVE-2026-89510 - RDMA/cxgb4: Cancel reg_work before freeing device on remove {CVE-2026-89510} * CVE-2026-89511 - qede: Fix NULL pointer dereference in TPA fragment processing {CVE-2026-89511} * CVE-2026-89512 - remoteproc: scp: Fix device reference leak on failed lookup {CVE-2026-89512} * CVE-2026-89515 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() {CVE-2026-89515} * CVE-2026-89524 - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets {CVE-2026-89524} * CVE-2026-89525 - udf: reject VAT indexes equal to the entry count {CVE-2026-89525} * CVE-2026-89538 - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field {CVE-2026-89538} * CVE-2026-89540 - sunrpc: init gssp_lock before publishing proc entry {CVE-2026-89540} * CVE-2026-89541 - SUNRPC: harden gss_unwrap_resp_priv length checks {CVE-2026-89541} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-89551 - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551} * CVE-2026-89554 - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction {CVE-2026-89554} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89557 - md: do overflow check for sb->bblog_shift in super_1_load() {CVE-2026-89557} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89562 - ip6_gre: fix hardware header length for NBMA tunnels {CVE-2026-89562} * CVE-2026-89563 - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() {CVE-2026-89563} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-89573 - dm array: reject an array block whose value size is not the caller's {CVE-2026-89573} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89576 - dm-era: fix shadowed superblock leak on take-snap failure {CVE-2026-89576} * CVE-2026-89582 - bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582} * CVE-2026-89586 - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes {CVE-2026-89586} * CVE-2026-89594 - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device {CVE-2026-89594} * CVE-2026-89595 - fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595} * CVE-2026-89596 - forcedeth: fix off-by-one when saving/restoring non-PCI config space {CVE-2026-89596} * CVE-2026-89597 - fbdev: uvesafb: unregister connector callback on init failure {CVE-2026-89597} * CVE-2026-89599 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display {CVE-2026-89599} * CVE-2026-89603 - entry: Fix seccomp bypass after ptrace with TSYNC {CVE-2026-89603} * CVE-2026-89605 - ecryptfs: release message context on send failure {CVE-2026-89605} * CVE-2026-89606 - ecryptfs: reject too-small tag 70 packets {CVE-2026-89606} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-89608 - ecryptfs: pass packet set buffer size to parser {CVE-2026-89608} * CVE-2026-89609 - ecryptfs: hold msg ctx list lock when cleaning daemon queue {CVE-2026-89609} * CVE-2026-89621 - HID: mcp2221: validate report size in mcp2221_raw_event() {CVE-2026-89621} * CVE-2026-89626 - HID: sensor: custom: Fix field sysfs group cleanup on failure {CVE-2026-89626} * CVE-2026-89627 - HID: roccat: free buffered reports when destroying device {CVE-2026-89627} * CVE-2026-89628 - HID: picolcd: clamp eeprom debugfs read to bytes actually received {CVE-2026-89628} * CVE-2026-89643 - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} * CVE-2026-89649 - ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89662 - NFSD: Prevent lock owner use-after-free during client teardown {CVE-2026-89662} * CVE-2026-89663 - nfsd: revoke copy-notify stateids before dropping their reference {CVE-2026-89663} * CVE-2026-89665 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE {CVE-2026-89665} * CVE-2026-89669 - nfsd: initialize copy-notify stateid before publishing it {CVE-2026-89669} * CVE-2026-89673 - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo {CVE-2026-89673} * CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} * CVE-2026-89684 - nfsd: fix cpntf publish race in nfs4_init_cp_state {CVE-2026-89684} * CVE-2026-89694 - nfsd: check client ownership when cancelling a copy-notify stateid {CVE-2026-89694} * CVE-2026-89696 - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref {CVE-2026-89696} * CVE-2026-89697 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() {CVE-2026-89697} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89704 - nfsd: sample writeback error cursor before async COPY loop {CVE-2026-89704} * CVE-2026-89706 - nfsd: Reset write verifier when async COPY writeback fails {CVE-2026-89706} * CVE-2026-89711 - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check {CVE-2026-89711} * CVE-2026-89712 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock {CVE-2026-89712} * CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check {CVE-2026-89720} * CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation {CVE-2026-89723} * CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder {CVE-2026-89724} * CVE-2026-89725 - media: cec: stm32: prevent out-of-bounds write on RX overflow {CVE-2026-89725} * CVE-2026-89726 - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726} * CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} * CVE-2026-89730 - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write {CVE-2026-89730} * CVE-2026-89732 - usb: gadget: f_fs: Prevent deadlock during ep0 read loop {CVE-2026-89732} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect {CVE-2026-89736} * CVE-2026-89741 - Revert "media: v4l2-dev: fix error handling in __video_register_device()" {CVE-2026-89741} * CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742} * CVE-2026-89749 - tracing: Fix crash passing ERR_PTR to kthread_stop() {CVE-2026-89749} * CVE-2026-89752 - mm: memcg: stop reclaim when a limit update is superseded {CVE-2026-89752} * CVE-2026-89753 - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() {CVE-2026-89753} * CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace {CVE-2026-89765} * CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777} * CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780} * CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} * CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} * CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789} * CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used {CVE-2026-89816} * CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() {CVE-2026-89821} * CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} * CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down {CVE-2026-89850} * CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs {CVE-2026-89851} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump {CVE-2026-89853} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855} * CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure {CVE-2026-89871} * CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link {CVE-2026-89872} * CVE-2026-89876 - media: tda18250: fix possible integer overflow {CVE-2026-89876} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879} * CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure {CVE-2026-89880} * CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak {CVE-2026-89881} * CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove {CVE-2026-89887} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect {CVE-2026-89891} * CVE-2026-89892 - media: em28xx: defer audio-only extension registration {CVE-2026-89892} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy {CVE-2026-89894} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() {CVE-2026-89896} * CVE-2026-89897 - media: cec: Serialize exclusive follower delivery {CVE-2026-89897} * CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901} * CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy {CVE-2026-89923} * CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path {CVE-2026-89924} * CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling {CVE-2026-89925} * CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937} * CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945} * CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946} * CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count {CVE-2026-89947} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89954 - mtd: afs: validate v2 image info bounds {CVE-2026-89954} * CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value {CVE-2026-89964} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs {CVE-2026-89968} * CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969} * CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973} * CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack {CVE-2026-89984} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015} * CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index {CVE-2026-90025} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit {CVE-2026-90054} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-90056 - net: fec: only stop PTP if it was initialized {CVE-2026-90056} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob {CVE-2026-90062} * CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path {CVE-2026-90071} * CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup {CVE-2026-90072} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow {CVE-2026-90074} * CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075} * CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version {CVE-2026-90102} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset {CVE-2026-90107} * CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges {CVE-2026-90114} * CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126} * CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path {CVE-2026-90128} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143} * CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} * CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook {CVE-2026-90157} * CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program {CVE-2026-90160} * CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers {CVE-2026-90202} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error {CVE-2026-90214} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt {CVE-2026-90218} * CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure {CVE-2026-90219} * CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete {CVE-2026-90224} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes {CVE-2026-90249} * CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length {CVE-2026-90251} * CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend {CVE-2026-90281} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests {CVE-2026-90284} * CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path {CVE-2026-90285} * CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286} * CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error {CVE-2026-90290} * CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} * CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293} * CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294} * CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once {CVE-2026-90295} * CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296} * CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error {CVE-2026-90297} * CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference {CVE-2026-90298} * CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} * CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults {CVE-2026-90303} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails {CVE-2026-90319} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-90341 - firmware: coreboot: Validate table bounds {CVE-2026-90341} * CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump {CVE-2026-90348} * CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work {CVE-2026-90360} * CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() {CVE-2026-90361} * CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) {CVE-2026-90362} * CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss {CVE-2026-90372} * CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} * CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices {CVE-2026-90386} * CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly {CVE-2026-90388} * CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone {CVE-2026-90391} * CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393} * CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove {CVE-2026-90394} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} * CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request {CVE-2026-90411} * CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420} * CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} * CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() {CVE-2026-92496} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback {CVE-2026-92501} * CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures {CVE-2026-92504} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() {CVE-2026-92524} * CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037} * CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure {CVE-2026-93039} * CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks {CVE-2026-93040} * CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates {CVE-2026-93041} * CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 {CVE-2026-93046} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice {CVE-2026-93049} * CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-93054 - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056} * CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061} * CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request {CVE-2026-93067} * CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095} * CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach {CVE-2026-93098} * CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core {CVE-2026-93110} * CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120} * CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux {CVE-2026-93138} * CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() {CVE-2026-93145} * CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails {CVE-2026-93158} * CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure {CVE-2026-93159} * CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160} * CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler {CVE-2026-93165} * CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path {CVE-2026-93167} * CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers {CVE-2026-93170} * CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177} * CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup {CVE-2026-93178} * CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range {CVE-2026-93183} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191} * CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203} * Miscellaneous upstream changes - Revert "USB: serial: keyspan_pda: fix information leak" - clocksource/drivers/timer-sun4i: Advertise a real minimum delta - include/linux/list.h: mark list_add and __list_add as __always_inline - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - powerpc/powermac: fix OF node refcount - staging: greybus: hid: fix SET_REPORT return value - USB: phy: fsl-usb: fix missing static keywords - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() - of: fix out-of-bounds read in of_alias_scan() stem parser - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: show filename encryption options - fat: restore original value when fat_ent_write failed - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - cpufreq: schedutil: Fix rate limit overflow - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - ipv6: use RCU iterator to dump route exceptions - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - rpmsg: glink: smem: order FIFO read after availability check - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - sctp: distinguish sequence zero from wildcard in reconf lookup - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Use file_ns_capable() when checking config space read access - iommu/vt-d: Fix no_iommu to disable platform opt-in - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - NTB: ntb_transport: Recycle TX entries before client callbacks - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - dm-switch: use WRITE_ONCE() in switch_region_table_write() - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - signal: avoid shared siginfo namespace rewrites - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - net: openvswitch: fix kernel-doc warnings in internal headers - RDMA/rxe: Fix over copying in get_srq_wqe - RDMA/rxe: Missing unlock on error in get_srq_wqe() - RDMA/rxe: Use the correct size of wqe when processing SRQ - selinux: avoid implicit conversions in services code - net: ntb_netdev: Fix TX busy and drop handling - tracing/mmiotrace: Remove reference to unused per CPU data pointer - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - dmaengine: dw-edma: Complete descriptors before pausing - ata: ahci: work around lost interrupts on Marvell 88SE61xx - Revert "irqchip/mbigen: Fix mbigen node address layout" - parisc: Fix alignment of asm statements in head.S - batman-adv: bla: prevent CRC corruptions after claim flush - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: Restore sigset on error path - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: fix i_size when pinned fallocate partially fails - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/hibmc: Fix list of formats on the primary plane - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - Input: aiptek - validate raw macro indices before updating state - firmware: stratix10-svc: Add mutex in stratix10 memory management - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - Smack: fix W=1 build warnings - smack: mark 'smack_enabled' global variable as __initdata - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - clk: moxart: remove unused variables, fix refcount leak - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - clk: imx: scu: Add A53 frequency scaling support - clk: imx: scu: Add A72 frequency scaling support - clk: imx: scu: drop redundant init.ops variable assignment - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - pinctrl: bcm2835: Don't remove an unregistered GPIO chip - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: add static port mapping support - soundwire: qcom: update port map allocation bit mask - soundwire: qcom: add static port map support - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - crypto: ecdh - move curve_id of ECDH from the key to algorithm name - crypto: atmel-ecc - Struct headers need to start with keyword 'struct' - crypto: atmel-ecc - replace min_t with min - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: sa2ul - Use the defined variable to clean code - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - of: Add cleanup.h based auto release via __free(device_node) markings - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - greybus: audio: bound the topology section sizes against the fetched size - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - irqchip/gic-v3-its: Fix memleak in its_probe_one() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - clk: qcom: gdsc: enable optional power domain support - clk: qcom: gdsc: Release pm subdomains in reverse add order - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - hwspinlock: propagate errno when registering single lock - driver core: platform: reorder functions - driver core: platform: change logic implementing platform_driver_probe - driver core: platform: use bus_type functions - driver core: platform: Emit a warning if a remove callback returned non-zero - platform: Provide a remove callback that returns no value - usb: renesas_usbhs: Fix power-off ordering on unbind - drm/panel: samsung-s6d16d0: Power off on prepare failure - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage - hwrng: ks-sa - access private data via struct hwrng - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Remove redundant PCI device ID validation - RDMA/hfi1: Create workqueues before device initialization - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - highmem: Provide generic variant of kmap_atomic* - iov_iter: lift memzero_page() to highmem.h - rpmsg: glink: Remove the rpmsg dev in close_ack - rpmsg: glink: remove duplicate code for rpmsg device remove - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - irqdomain: Introduce irq_domain_instantiate() - irqdomain: Handle additional domain flags in irq_domain_instantiate() - cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate() - cpufreq: schedutil: Add util to struct sg_cpu - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - gpu: host1x: Fix offset calculation in trace_write_gather - media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro - ACPI: move from strlcpy() with unused retval to strscpy() - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: ad525x_dpot: Make ad_dpot_remove() return void - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: remove layering violation for the soc_bus - driver core: soc: Unregister bus on early device registration failure - dmaengine: dw-edma: Clear stale requests on termination - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - ext4: skip extra isize expansion during mount to prevent deadlock - scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: qla2xxx: Move sess cmd list/lock to driver - scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls() - scsi: target: core: Rename transport_init_se_cmd() - scsi: target: core: Break up target_submit_cmd_map_sgls() - scsi: target: srpt: Convert to new submission API - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - RDMA/restrack: Fix typos in the comments - iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - thermal: int340x_thermal: Consolidate priv->data_vault checks - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ath11k: add trace log support - ARM: dts: allwinner: a10: Fix PMU interrupt - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - leds: pca9532: Fix phantom device registration on missing hardware - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - arm64: dts: rockchip: Add gru-scarlet-dumo board - arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - ARM: lpc32xx: only run SoC init on LPC32xx hardware - power: supply: sbs-battery: cache constant string properties - power: supply: sbs-battery: Use a per-device serial number buffer - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - remoteproc: Remove useless check in rproc_del() - remoteproc: Add new RPROC_ATTACHED state - remoteproc: use freezable workqueue for crash notifications - remoteproc: Use unbounded workqueue for recovery work - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - RDMA/efa: Fix PBL chunk length computation - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - RDMA/mlx5: Send cong param changes to the resolved port mdev - md/raid5-ppl: fix use-after-free in ppl_do_flush() - selftests/zram: fix kernel_gte() for POSIX sh - power: supply: sc2731_charger: Convert to platform remove callback returning void - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - i3c: master: Fix device_register() error path - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - perf: arm_spe: Make wakeup range check overflow safe - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Use snprintf() for guestmount path construction - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - iommu/arm-smmu-v3: Convert to use atomic poll timeout - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - mac80211: add ieee80211_is_tx_data helper function - firmware: coreboot: Check size of table entry and use flex-array - firmware: google: Add bounds checks in coreboot_table_populate() - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - HID: split apart hid_device_probe to make logic more apparent - HID: ensure timely release of driver-allocated resources - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - PCI/sysfs: Add static PCI resource attribute macros - remoteproc: Add a rproc_set_firmware() API - remoteproc: Add new detach() remoteproc operation - remoteproc: Introduce function __rproc_detach() - remoteproc: Introduce function rproc_detach() - remoteproc: Fix various kernel-doc warnings - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - scripts/tags.sh: improve compiled sources generation - scripts/tags.sh: Prevent binary files appearing in cscope.files - ocfs2: use bitmap API in fill_node_map - drm/sun4i: vi scaler: Fix coefficient selection - of: property: add missing kerneldoc for of_graph_get_endpoint_count() - of: property: use unsigned int return on of_graph_get_endpoint_count() - bitfield: Add less-checking __FIELD_{GET,PREP}() - bitfield: Add non-constant field_{prep,get}() helpers - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - RDMA/siw: Introduce siw_free_cm_id - arm64: hibernate: mask DAIF before restoring hibernated kernel - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - firmware_loader: Check fw_state_is_done in loading_store - pinctrl: rockchip: Reset the pin count when recalculating SoC data - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - sched/fair: Introduce a CPU capacity comparison helper - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - perf trace-event: Fix integer truncation in do_read() and skip() - iio: light: gp2ap002: re-enable irq if runtime suspend fails - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Clear screen only if output file is a tty - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - iommu/vt-d: Fix UCTP context table slot when copying root entries - m68k: Fix backtraces for non-running tasks - powerpc/configs: enable CONFIG_RAS to fix EDAC support - spi: sprd-adi: Fix probe succeeding without registering the controller - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - ubi: Fix repeated words in comments - ubi: fastmap: Use the bitmap API to allocate bitmaps - ubi: fastmap: Fix missed ec updating after erasing old fastmap data block - ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash - ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap - ubi: Replace erase_block() with sync_erase() - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl - ubi: fastmap: Add fastmap control support for module parameter - ubi: Simplify bool conversion - ubi: fastmap: Wait until there are enough free PEBs before filling pools - ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs - ubi: fastmap: Add module parameter to control reserving filling pool PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - spi: img-spfi: don't disable runtime PM on DMA deferred probe - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - ocfs2: fix circular locking dependency in ocfs2_init_acl() - bpf: Fix pending_pos walk on 32-bit ring position wrap - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - mailbox: rockchip: disable pclk on probe failure and unbind - hwmon: (emc1403) Add support for EMC1442 - NFS: Always clear an invalid mapping when attempting a buffered write - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - NFSv4/pnfs: Clean up layout get on open - nfs: refactor pNFS functions using clear_and_wake_up_bit - pppox: drain queued packets on channel handoff - hsr: Use a single struct for self_node. - net: hsr: Use full string description when opening HSR network device - net: bridge: vlan: fix inverted default vlan notification - ALSA: hda: Fix connection list comparison in proc output - 8139cp: fix Rx and Tx not being disabled in cp_suspend - vsock: use sock_error() to consume sk_err after a failed connect - bonding: initialize err for empty target lists - virtio_balloon: disable indirect descriptors - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - RDMA/ucma: Allow path records to exactly fit the output buffer - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - forcedeth: stop the tx_timeout register dump past the requested window - nfs: move the nfs4_data_server_cache into struct nfs_net - scsi: qla2xxx: Fix an loop timeout test - Bluetooth: compute LE flow credits based on recvbuf space - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - cifs: fix clearing stats for fastest execution of each smb2 command - net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() - net_sched: sch_fq: struct sched_data reorg - net_sched: sch_fq: change how @inactive is tracked - net_sched: export pfifo_fast prio2band[] - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - apparmor: policy_int make sure list heads are initialized before fail path - net: ethernet: sun4i-emac: Fix IRQ error handling - netfilter: xt_cgroup: Make it independent from net_cls - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests/arm64: Treat KSM merge_across_nodes as optional - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - driver core: platform: don't oops in platform_shutdown() on unbound devices - crypto: ecdh - extend 'cra_driver_name' with curve name - crypto: ecdh - fix 'ecdh_init' - crypto: ecdh - fix ecdh-nist-p192's entry in testmgr - crypto: testmgr - fix initialization of 'secret_size' - clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled - mm/highmem: Take kmap_high_get() properly into account - ACPI: utils: Document for_each_acpi_dev_match() macro - HID: fix an error code in hid_check_device_match() - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Linux 5.10.270 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Update to upstream stable Linux 5.10.270 (from 5.10.269). * Bump kernel ABI to 49: ship the ELS kernel as 5.10.0-49-*, distinct from the prior 5.10.0-48. * CVE-2022-48650 - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650} * CVE-2023-52676 - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676} * CVE-2023-54237 - net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link() {CVE-2023-54237} * CVE-2024-41062 - bluetooth/l2cap: sync sock recv cb and release {CVE-2024-41062} * CVE-2025-21651 - net: hns3: don't auto enable misc vector {CVE-2025-21651} * CVE-2025-22103 - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103} * CVE-2025-38097 - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097} * CVE-2025-40123 - bpf: Enforce expected_attach_type for tailcall compatibility {CVE-2025-40123} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2026-31420 - bridge: mrp: reject zero test interval to avoid OOM panic {CVE-2026-31420} * CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2026-46158 - mptcp: pm: ADD_ADDR rtx: always decrease sk refcount {CVE-2026-46158} * CVE-2026-46170 - mptcp: pm: ADD_ADDR rtx: free sk if last {CVE-2026-46170} * CVE-2026-53078 - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} * CVE-2026-72255 - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} * CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} * CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe {CVE-2026-74378} * CVE-2026-74565 - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} * CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON {CVE-2026-80671} * CVE-2026-80689 - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions {CVE-2026-80689} * CVE-2026-80888 - drm/vmwgfx: drop dma_buf reference on foreign-fd prime import {CVE-2026-80888} * CVE-2026-80912 - selinux: reject an unclaimed class value in security_get_classes() {CVE-2026-80912} * CVE-2026-80930 - tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout {CVE-2026-80930} * CVE-2026-80931 - w1: ds28e17: reject an oversize length on an I2C block read {CVE-2026-80931} * CVE-2026-80932 - vsock/virtio: flush works in dependency order {CVE-2026-80932} * CVE-2026-80941 - wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() {CVE-2026-80941} * CVE-2026-80944 - wifi: mwifiex: Detach sync cmd buffer on interrupted wait {CVE-2026-80944} * CVE-2026-80949 - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949} * CVE-2026-80952 - i3c: master: Fix info leak and UAF in device unregister path {CVE-2026-80952} * CVE-2026-80963 - dm-stats: fix a crash if allocation of per-cpu data fails {CVE-2026-80963} * CVE-2026-80965 - ALSA: serial-u16550: Check card index validity at probe {CVE-2026-80965} * CVE-2026-80966 - ALSA: portman2x4: Check card index validity at probe {CVE-2026-80966} * CVE-2026-80968 - ALSA: mts64: Check card index validity at probe {CVE-2026-80968} * CVE-2026-80969 - ALSA: mpu401: Check card index validity at probe {CVE-2026-80969} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-80973 - ALSA: 6fire: bound the MIDI event length from the device {CVE-2026-80973} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-80977 - net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977} * CVE-2026-80978 - net: cap advertised IP tunnel headroom {CVE-2026-80978} * CVE-2026-80987 - NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987} * CVE-2026-80988 - NTB: ntb_transport: Fail TX enqueue when the QP link is down {CVE-2026-80988} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-81002 - xdp: fix zero-copy frame layout {CVE-2026-81002} * CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} * CVE-2026-81005 - ipmi: si: Fix NULL pointer dereference after failed registration {CVE-2026-81005} * CVE-2026-81007 - ipmi: ipmb: validate write message length {CVE-2026-81007} * CVE-2026-81008 - interconnect: Fix use after free in icc_get() and of_icc_get_by_index() {CVE-2026-81008} * CVE-2026-81017 - platform/chrome: sensorhub: Bound the EC-reported sensor number {CVE-2026-81017} * CVE-2026-89440 - mmc: via-sdmmc: stop card-detect handling on probe failure {CVE-2026-89440} * CVE-2026-89456 - s390/dasd: Propagate partial completion length across ERP recovery {CVE-2026-89456} * CVE-2026-89457 - s390/dasd: Guard sysfs discipline callbacks against unallocated private data {CVE-2026-89457} * CVE-2026-89458 - s390/dasd: Do not complete a failed ESE read as successful {CVE-2026-89458} * CVE-2026-89461 - power: supply: max17040: synchronize work cancellation on suspend {CVE-2026-89461} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-89470 - power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS {CVE-2026-89470} * CVE-2026-89471 - power: supply: cros_usbpd-charger: bound the EC-reported port count {CVE-2026-89471} * CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-89479 - sctp: stop processing a packet once its association is deleted {CVE-2026-89479} * CVE-2026-89482 - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482} * CVE-2026-89483 - nvme: zero the discard fallback page {CVE-2026-89483} * CVE-2026-89485 - lockd: pin next file across nlm_inspect_file lock-drop {CVE-2026-89485} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} * CVE-2026-89489 - openrisc: fix arbitrary kernel memory access via or1k_atomic syscall {CVE-2026-89489} * CVE-2026-89490 - ocfs2: fix readdir position truncation on 32-bit kernels {CVE-2026-89490} * CVE-2026-89491 - ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() {CVE-2026-89491} * CVE-2026-89493 - ocfs2: validate rl_used against rl_count in refcount block validator {CVE-2026-89493} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89496 - ocfs2: always run deallocs on copy-on-write completion {CVE-2026-89496} * CVE-2026-89497 - orangefs: skip leading spaces before parsing client debug masks {CVE-2026-89497} * CVE-2026-89498 - orangefs: fix double-free of trailer_buf on readdir copy failure {CVE-2026-89498} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-89508 - RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508} * CVE-2026-89510 - RDMA/cxgb4: Cancel reg_work before freeing device on remove {CVE-2026-89510} * CVE-2026-89511 - qede: Fix NULL pointer dereference in TPA fragment processing {CVE-2026-89511} * CVE-2026-89512 - remoteproc: scp: Fix device reference leak on failed lookup {CVE-2026-89512} * CVE-2026-89515 - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() {CVE-2026-89515} * CVE-2026-89524 - wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets {CVE-2026-89524} * CVE-2026-89525 - udf: reject VAT indexes equal to the entry count {CVE-2026-89525} * CVE-2026-89538 - SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field {CVE-2026-89538} * CVE-2026-89540 - sunrpc: init gssp_lock before publishing proc entry {CVE-2026-89540} * CVE-2026-89541 - SUNRPC: harden gss_unwrap_resp_priv length checks {CVE-2026-89541} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-89551 - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551} * CVE-2026-89554 - mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction {CVE-2026-89554} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89557 - md: do overflow check for sb->bblog_shift in super_1_load() {CVE-2026-89557} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89562 - ip6_gre: fix hardware header length for NBMA tunnels {CVE-2026-89562} * CVE-2026-89563 - ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() {CVE-2026-89563} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-89573 - dm array: reject an array block whose value size is not the caller's {CVE-2026-89573} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89576 - dm-era: fix shadowed superblock leak on take-snap failure {CVE-2026-89576} * CVE-2026-89582 - bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582} * CVE-2026-89586 - ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes {CVE-2026-89586} * CVE-2026-89594 - hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device {CVE-2026-89594} * CVE-2026-89595 - fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595} * CVE-2026-89596 - forcedeth: fix off-by-one when saving/restoring non-PCI config space {CVE-2026-89596} * CVE-2026-89597 - fbdev: uvesafb: unregister connector callback on init failure {CVE-2026-89597} * CVE-2026-89599 - fbdev: omapfb: panel-dsi-cm: initialize lock before registering display {CVE-2026-89599} * CVE-2026-89603 - entry: Fix seccomp bypass after ptrace with TSYNC {CVE-2026-89603} * CVE-2026-89605 - ecryptfs: release message context on send failure {CVE-2026-89605} * CVE-2026-89606 - ecryptfs: reject too-small tag 70 packets {CVE-2026-89606} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-89608 - ecryptfs: pass packet set buffer size to parser {CVE-2026-89608} * CVE-2026-89609 - ecryptfs: hold msg ctx list lock when cleaning daemon queue {CVE-2026-89609} * CVE-2026-89621 - HID: mcp2221: validate report size in mcp2221_raw_event() {CVE-2026-89621} * CVE-2026-89626 - HID: sensor: custom: Fix field sysfs group cleanup on failure {CVE-2026-89626} * CVE-2026-89627 - HID: roccat: free buffered reports when destroying device {CVE-2026-89627} * CVE-2026-89628 - HID: picolcd: clamp eeprom debugfs read to bytes actually received {CVE-2026-89628} * CVE-2026-89643 - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} * CVE-2026-89649 - ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89662 - NFSD: Prevent lock owner use-after-free during client teardown {CVE-2026-89662} * CVE-2026-89663 - nfsd: revoke copy-notify stateids before dropping their reference {CVE-2026-89663} * CVE-2026-89665 - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE {CVE-2026-89665} * CVE-2026-89669 - nfsd: initialize copy-notify stateid before publishing it {CVE-2026-89669} * CVE-2026-89673 - nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo {CVE-2026-89673} * CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} * CVE-2026-89684 - nfsd: fix cpntf publish race in nfs4_init_cp_state {CVE-2026-89684} * CVE-2026-89694 - nfsd: check client ownership when cancelling a copy-notify stateid {CVE-2026-89694} * CVE-2026-89696 - nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref {CVE-2026-89696} * CVE-2026-89697 - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() {CVE-2026-89697} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89704 - nfsd: sample writeback error cursor before async COPY loop {CVE-2026-89704} * CVE-2026-89706 - nfsd: Reset write verifier when async COPY writeback fails {CVE-2026-89706} * CVE-2026-89711 - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check {CVE-2026-89711} * CVE-2026-89712 - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock {CVE-2026-89712} * CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check {CVE-2026-89720} * CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation {CVE-2026-89723} * CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder {CVE-2026-89724} * CVE-2026-89725 - media: cec: stm32: prevent out-of-bounds write on RX overflow {CVE-2026-89725} * CVE-2026-89726 - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726} * CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} * CVE-2026-89730 - fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write {CVE-2026-89730} * CVE-2026-89732 - usb: gadget: f_fs: Prevent deadlock during ep0 read loop {CVE-2026-89732} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89736 - usb: gadget: u_audio: Fix use-after-free on sound card disconnect {CVE-2026-89736} * CVE-2026-89741 - Revert "media: v4l2-dev: fix error handling in __video_register_device()" {CVE-2026-89741} * CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742} * CVE-2026-89749 - tracing: Fix crash passing ERR_PTR to kthread_stop() {CVE-2026-89749} * CVE-2026-89752 - mm: memcg: stop reclaim when a limit update is superseded {CVE-2026-89752} * CVE-2026-89753 - mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() {CVE-2026-89753} * CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace {CVE-2026-89765} * CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777} * CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780} * CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} * CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} * CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789} * CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used {CVE-2026-89816} * CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() {CVE-2026-89821} * CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} * CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down {CVE-2026-89850} * CVE-2026-89851 - scsi: qla2xxx: Fix FCE trace enable parsing in debugfs {CVE-2026-89851} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2026-89853 - scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump {CVE-2026-89853} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855} * CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure {CVE-2026-89871} * CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link {CVE-2026-89872} * CVE-2026-89876 - media: tda18250: fix possible integer overflow {CVE-2026-89876} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879} * CVE-2026-89880 - media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure {CVE-2026-89880} * CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak {CVE-2026-89881} * CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove {CVE-2026-89887} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89891 - media: em28xx: fix use-after-free of dev_next->devlist on disconnect {CVE-2026-89891} * CVE-2026-89892 - media: em28xx: defer audio-only extension registration {CVE-2026-89892} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-89894 - media: cx231xx: reject geometry changes while the VBI queue is busy {CVE-2026-89894} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2026-89896 - media: cedrus: fix memory leak in cedrus_init_ctrls() {CVE-2026-89896} * CVE-2026-89897 - media: cec: Serialize exclusive follower delivery {CVE-2026-89897} * CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901} * CVE-2026-89923 - KVM: s390: Free guest debug data on vcpu destroy {CVE-2026-89923} * CVE-2026-89924 - KVM: s390: Fix old_data leak in guest debug error path {CVE-2026-89924} * CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling {CVE-2026-89925} * CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937} * CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945} * CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946} * CVE-2026-89947 - clk: meson: align gxbb_32k_clk_sel number of parents with actual count {CVE-2026-89947} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89954 - mtd: afs: validate v2 image info bounds {CVE-2026-89954} * CVE-2026-89964 - parisc: eisa: Fix infinite loop when parsing invalid IRQ value {CVE-2026-89964} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs {CVE-2026-89968} * CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969} * CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973} * CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-89984 - perf/x86/intel: Fix kernel address leakages in LBR stack {CVE-2026-89984} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015} * CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index {CVE-2026-90025} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit {CVE-2026-90054} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-90056 - net: fec: only stop PTP if it was initialized {CVE-2026-90056} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob {CVE-2026-90062} * CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-90071 - net/sched: sch_teql: restore skb->dev on the slave failure path {CVE-2026-90071} * CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup {CVE-2026-90072} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90074 - net/sched: fq_pie: clamp default quantum to avoid signed overflow {CVE-2026-90074} * CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075} * CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version {CVE-2026-90102} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-90107 - net/smc: free pending qentry in smc_llc_flow_stop() before memset {CVE-2026-90107} * CVE-2026-90114 - net: bridge: Reject descending VLAN tunnel ranges {CVE-2026-90114} * CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126} * CVE-2026-90128 - vdpa/mlx5: fix wrong list iterated in add_direct_chain error path {CVE-2026-90128} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143} * CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} * CVE-2026-90157 - bpf: Reject negative optlen in cgroup getsockopt hook {CVE-2026-90157} * CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program {CVE-2026-90160} * CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers {CVE-2026-90202} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error {CVE-2026-90214} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-90218 - RDMA/cma: Fix WARNING in res_to_rt {CVE-2026-90218} * CVE-2026-90219 - RDMA/cxgb4: Free debugfs on registration failure {CVE-2026-90219} * CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-90224 - nfc: nci: fix double completion race in nci_data_exchange_complete {CVE-2026-90224} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-90249 - iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes {CVE-2026-90249} * CVE-2026-90251 - Bluetooth: MSFT: validate evt_prefix_len against the response length {CVE-2026-90251} * CVE-2026-90281 - phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend {CVE-2026-90281} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-90284 - firmware_loader: do not queue completed sysfs fallback requests {CVE-2026-90284} * CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path {CVE-2026-90285} * CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286} * CVE-2026-90290 - arm64: hibernate: Restore DAIF state on error {CVE-2026-90290} * CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} * CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293} * CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294} * CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once {CVE-2026-90295} * CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296} * CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error {CVE-2026-90297} * CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference {CVE-2026-90298} * CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} * CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults {CVE-2026-90303} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90319 - rapidio: clear mport->net when rio_add_net() fails {CVE-2026-90319} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-90341 - firmware: coreboot: Validate table bounds {CVE-2026-90341} * CVE-2026-90348 - wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump {CVE-2026-90348} * CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work {CVE-2026-90360} * CVE-2026-90361 - wifi: ath11k: fix leak in ath11k_service_ready_ext_event() {CVE-2026-90361} * CVE-2026-90362 - drm/msm/dsi: Drop dev_pm_opp_set_rate(0) {CVE-2026-90362} * CVE-2026-90372 - wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss {CVE-2026-90372} * CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} * CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices {CVE-2026-90386} * CVE-2026-90388 - iommu/dma: Check atomic pool allocation result directly {CVE-2026-90388} * CVE-2026-90391 - lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone {CVE-2026-90391} * CVE-2026-90393 - bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393} * CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove {CVE-2026-90394} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} * CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request {CVE-2026-90411} * CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420} * CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} * CVE-2026-92496 - wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() {CVE-2026-92496} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-92501 - ext4: drain in-flight DIO before buffered write fallback {CVE-2026-92501} * CVE-2026-92504 - thermal: intel: int3400: clean up ODVP on probe failures {CVE-2026-92504} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() {CVE-2026-92524} * CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037} * CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure {CVE-2026-93039} * CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks {CVE-2026-93040} * CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates {CVE-2026-93041} * CVE-2026-93046 - software node: Fix software_node_get_reference_args() with index -1 {CVE-2026-93046} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice {CVE-2026-93049} * CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-93054 - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056} * CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061} * CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request {CVE-2026-93067} * CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095} * CVE-2026-93098 - rpmsg: glink: fix deadlock in endpoint destroy during driver detach {CVE-2026-93098} * CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core {CVE-2026-93110} * CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120} * CVE-2026-93138 - bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux {CVE-2026-93138} * CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-93145 - clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() {CVE-2026-93145} * CVE-2026-93158 - crypto: sa2ul - stop probe if context pool creation fails {CVE-2026-93158} * CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure {CVE-2026-93159} * CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160} * CVE-2026-93165 - platform/chrome: sensorhub: Fix memory overread in ring handler {CVE-2026-93165} * CVE-2026-93167 - csky: Fix a4/a5 restoration in syscall trace path {CVE-2026-93167} * CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers {CVE-2026-93170} * CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177} * CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup {CVE-2026-93178} * CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range {CVE-2026-93183} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191} * CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203} * Miscellaneous upstream changes - Revert "USB: serial: keyspan_pda: fix information leak" - clocksource/drivers/timer-sun4i: Advertise a real minimum delta - include/linux/list.h: mark list_add and __list_add as __always_inline - tools/compiler: match glibc 2.42 definition of __attribute_const__ - x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() - powerpc/powermac: fix OF node refcount - staging: greybus: hid: fix SET_REPORT return value - USB: phy: fsl-usb: fix missing static keywords - usb: gadget: snps_udc_plat: clean up PHY on probe deferral - usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() - of: fix out-of-bounds read in of_alias_scan() stem parser - NFSD: Encode only the status in NFS-ACL v2 GETACL error replies - NFSD: Fix off-by-one in DRC bucket pruning limit - nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types - nfsd: add filehandle match check to nfsd4_delegreturn() - nfsd: fix version mismatch loops in nfsd_acl_init_request() - nfsd: reject reclaim LOCK after RECLAIM_COMPLETE - eCryptfs: bound the packet-length peek to the user buffer - ecryptfs: fix tag 11 packet exact-fit size check - ecryptfs: show filename encryption options - fat: restore original value when fat_ent_write failed - fbdev: pvr2fb: correct user pointer annotation and sentinel initializer - fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration - alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() - alpha: marvel: Fix irq_set_status_flags to use correct IRQ number - alpha: marvel: Fix lock ordering in init_io7_irqs() - Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU - Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU - cpufreq: schedutil: Fix rate limit overflow - Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative - Bluetooth: hci_uart: Fix false success return in hci_uart_setup() - Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection - Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative - ipv6: use RCU iterator to dump route exceptions - SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat - rpmsg: glink: smem: order FIFO read after availability check - regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata - ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item - ocfs2: cluster: fix o2hb_dependent_users leak on pin failure - hwmon: (max6621) fix negative temperature offset and crit readings - hwmon: (max6621) fix temperature clamp range - nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path - sctp: distinguish sequence zero from wildcard in reconf lookup - PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk - PCI: meson: Fix GPIO state while requesting PERST# - PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Avoid spurious runtime PM wakeup on config space accesses - PCI/proc: Use file_ns_capable() when checking config space read access - iommu/vt-d: Fix no_iommu to disable platform opt-in - net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition - net: openvswitch: fix nf_connlabels leak in ovs_ct_init - NTB: ntb_transport: Recycle TX entries before client callbacks - net: ntb_netdev: Avoid double-accounting netif_rx() drops - net: ntb_netdev: Count packets dropped on RX refill failure - PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip - dm-switch: use WRITE_ONCE() in switch_region_table_write() - wifi: rtl818x: initialize eeprom_93cx6 struct to zero - signal: avoid shared siginfo namespace rewrites - timer: Keep debugobjects state consistent in migrate_timer_list() - udf: Fix i_lenExtents truncation on 32-bit kernels - platform/chrome: sensorhub: Fix dropped timestamp events and log spam - net: openvswitch: fix kernel-doc warnings in internal headers - RDMA/rxe: Fix over copying in get_srq_wqe - RDMA/rxe: Missing unlock on error in get_srq_wqe() - RDMA/rxe: Use the correct size of wqe when processing SRQ - selinux: avoid implicit conversions in services code - net: ntb_netdev: Fix TX busy and drop handling - tracing/mmiotrace: Remove reference to unused per CPU data pointer - usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns() - thermal/drivers/imx: Disable clock on runtime resume failure - thermal/drivers/qoriq: Disable clock on resume failure - dmaengine: dw-edma: Complete descriptors before pausing - ata: ahci: work around lost interrupts on Marvell 88SE61xx - Revert "irqchip/mbigen: Fix mbigen node address layout" - parisc: Fix alignment of asm statements in head.S - batman-adv: bla: prevent CRC corruptions after claim flush - clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk - clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk - i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure - ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure - AsoC: intel: sst: fix PCI device reference leak on probe failure - ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get - iio: gyro: mpu3050: fix sign of raw angular velocity readings - iio: light: cm32181: return zero after writing calibscale - iio: light: gp2ap002: Disable regulators on resume failure - iio: srf04: fix pm_runtime handling on probe error path - iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register() - KVM: s390: Zero initialize irq in reinject_machine_check - KVM: s390: Restore sigset on error path - media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash - media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common - media: venus: fix payload size returned by parse_caps() and parse_alloc_mode() - media: venus: fix payload size calculation in parse_raw_formats() - media: vimc: fix pixel format lookup in enum_framesizes - scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters - scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config() - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition - scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics - f2fs: return symlink writeback errors - f2fs: reject overlapping move range after len expansion - f2fs: fix i_size when pinned fallocate partially fails - drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure - drm/sun4i: fix refcount leak in sun4i_backend_init_sat() - drm/hibmc: Fix list of formats on the primary plane - drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT - Input: aiptek - validate raw macro indices before updating state - firmware: stratix10-svc: Add mutex in stratix10 memory management - drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure - Smack: fix W=1 build warnings - smack: mark 'smack_enabled' global variable as __initdata - smack: simplify write handlers of sysfs entries - smack: deduplicate smackfs/{direct,mapped} file_operations - smack: restrict smackfs/{direct,mapped} values to 0-255 - soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap() - media: cec-pin: Fix event FIFO ordering - clk: moxart: remove unused variables, fix refcount leak - clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller - ARM: imx: fix device_node refcount leak in imx_src_init() - clk: imx: scu: Add A53 frequency scaling support - clk: imx: scu: Add A72 frequency scaling support - clk: imx: scu: drop redundant init.ops variable assignment - perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails - pinctrl: bcm2835: Don't remove an unregistered GPIO chip - media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define - media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define - dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure - dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe - soundwire: add static port mapping support - soundwire: qcom: update port map allocation bit mask - soundwire: qcom: add static port map support - soundwire: qcom: Fix port exhaustion check in stream_alloc_ports - iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure - selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check - crypto: ecdh - move curve_id of ECDH from the key to algorithm name - crypto: atmel-ecc - Struct headers need to start with keyword 'struct' - crypto: atmel-ecc - replace min_t with min - crypto: atmel-ecc - clean up and improve ECDH comments - crypto: sa2ul - Use the defined variable to clean code - nvmet-rdma: factor out response resource cleanup - bus: ti-sysc: Fix /chosen node reference leak - PM: sleep: Fix off-by-one in wakelocks number limit check - of: Add cleanup.h based auto release via __free(device_node) markings - staging: greybus: audio: correct sscanf() return value check - staging: sm750fb: gate dualview dataflow using g_dualview - greybus: audio: bound the topology section sizes against the fetched size - staging: fbtft: Use sysfs_emit_at() to print to sysfs file - staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown - staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown - staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() - ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer() - selftests/bpf: Fix memory leak in msg_alloc_iov error path - selftests/bpf: Fix memory leak in msg_alloc_iov - irqchip/gic-v3-its: Fix memleak in its_probe_one() - selftests: timers: leap-a-day: Fix -w option and update usage comment - clocksource: Unregister subsystem on device registration failure - y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32 - timekeeping: Account for monotonicity adjustment in ntp_error - clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status - clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains - clk: qcom: gdsc: enable optional power domain support - clk: qcom: gdsc: Release pm subdomains in reverse add order - clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code - iommu/msm: Return -ENOMEM on memory allocation failure in probe - iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors - iommu/amd: Add support for Hygon family 18h model 4h IOAPIC - iommu/amd: Fix false positive in SB IOAPIC IVRS validation - leds: pca9532: Fix inverted GPIO output polarity - hwspinlock: propagate errno when registering single lock - driver core: platform: reorder functions - driver core: platform: change logic implementing platform_driver_probe - driver core: platform: use bus_type functions - driver core: platform: Emit a warning if a remove callback returned non-zero - platform: Provide a remove callback that returns no value - usb: renesas_usbhs: Fix power-off ordering on unbind - drm/panel: samsung-s6d16d0: Power off on prepare failure - iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE - RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage - hwrng: ks-sa - access private data via struct hwrng - hwrng: ks-sa - Fix runtime PM cleanup on registration failure - ALSA: hpi: Check transport errors during HPI6000 adapter initialization - pmdomain: bcm: bcm2835: handle genpd provider registration errors - misc: rtsx_usb: avoid USB I/O in runtime autosuspend - RDMA/hfi1: Remove redundant PCI device ID validation - RDMA/hfi1: Create workqueues before device initialization - RDMA/hfi1: Stop flushing the global IB workqueue - RDMA/hfi1: Initialize debugfs after probe completes - highmem: Provide generic variant of kmap_atomic* - iov_iter: lift memzero_page() to highmem.h - rpmsg: glink: Remove the rpmsg dev in close_ack - rpmsg: glink: remove duplicate code for rpmsg device remove - wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate - libnvdimm/labels: Bound the on-media label size before the shift - cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate() - irqdomain: Introduce irq_domain_instantiate() - irqdomain: Handle additional domain flags in irq_domain_instantiate() - cpufreq: intel_pstate: Simplify intel_cpufreq_update_pstate() - cpufreq: schedutil: Add util to struct sg_cpu - cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply() - remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev - gpu: host1x: Fix offset calculation in trace_write_gather - media: ACPI / bus: Add acpi_dev_get_next_match_dev() and helper macro - ACPI: move from strlcpy() with unused retval to strscpy() - ACPI: processor: idle: Expand _LPI package sanity checks - tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64 - accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status() - misc: rtsx: add missing write register handling - misc: ad525x_dpot: Make ad_dpot_remove() return void - ppdev: prevent overflow when setting port timeout - char: xilinx_hwicap: unregister class on init errors - perf ui hists: Fix uninitialized stack memory free on pstack allocation failure - driver core: soc: remove layering violation for the soc_bus - driver core: soc: Unregister bus on early device registration failure - dmaengine: dw-edma: Clear stale requests on termination - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters - ext4: skip extra isize expansion during mount to prevent deadlock - scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: target: Remove TARGET_SCF_LOOKUP_LUN_FROM_TAG - scsi: qla2xxx: Move sess cmd list/lock to driver - scsi: target: core: Replace in_interrupt() usage in target_submit_cmd_map_sgls() - scsi: target: core: Rename transport_init_se_cmd() - scsi: target: core: Break up target_submit_cmd_map_sgls() - scsi: target: srpt: Convert to new submission API - RDMA/srpt: Pass the mapped task attribute to target_init_cmd() - RDMA/restrack: Fix typos in the comments - iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe - iommu/qcom: Remove sysfs device on probe failure path - iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() - thermal: int340x_thermal: Consolidate priv->data_vault checks - wifi: ath11k: Correctly copy the hint BSSID in WMI scan request - ath11k: add trace log support - ARM: dts: allwinner: a10: Fix PMU interrupt - perf cs-etm: Flush thread stacks after decoder reset - perf cs-etm: Avoid truncating AUX buffer sizes to int - leds: pca9532: Fix phantom device registration on missing hardware - drm/tve200: add OF module alias for autoloading - netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet - arm64: dts: rockchip: Add gru-scarlet-dumo board - arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru - arm64: dts: rockchip: Fix Gru WLAN sideband interrupt - ARM: lpc32xx: only run SoC init on LPC32xx hardware - power: supply: sbs-battery: cache constant string properties - power: supply: sbs-battery: Use a per-device serial number buffer - w1: ds2482: Fix signedness bug in ds2482_w1_triplet() - remoteproc: Remove useless check in rproc_del() - remoteproc: Add new RPROC_ATTACHED state - remoteproc: use freezable workqueue for crash notifications - remoteproc: Use unbounded workqueue for recovery work - remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work() - staging: rtl8723bs: use kfree_sensitive() for key material - RDMA/efa: Fix PBL chunk length computation - arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix - clk: tegra: tegra124-emc: put EMC node on register failure - clk: palmas: Manage external-control prepare with devm - clk/x86: pmc_atom: add kasprintf return value check - RDMA/mlx5: Send cong param changes to the resolved port mdev - md/raid5-ppl: fix use-after-free in ppl_do_flush() - selftests/zram: fix kernel_gte() for POSIX sh - power: supply: sc2731_charger: Convert to platform remove callback returning void - clk: qcom: Return expected ENOMEM error on dynamic allocation failure - i3c: master: Fix device_register() error path - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() - misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe() - fanotify: report full event length for FIONREAD - wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields - perf: arm_spe: Make wakeup range check overflow safe - perf machine: Guard against NULL strlist in machines__findnew() - perf machine: Use snprintf() for guestmount path construction - perf machine: Check snprintf truncation in machines__findnew() - perf machine: Don't abort guest map creation on first inaccessible dir - perf machine: Reset errno before strtol in guest kernel map creation - perf machine: Free scandir entries in guest kernel map creation - perf machine: Check snprintf truncation for guest kallsyms path - iommu/arm-smmu-v3: Convert to use atomic poll timeout - wifi: zd1211rw: reject secondary interfaces to prevent conflicts - mac80211: add ieee80211_is_tx_data helper function - firmware: coreboot: Check size of table entry and use flex-array - firmware: google: Add bounds checks in coreboot_table_populate() - powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass - MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL - serial: amba-pl011: unprepare console clock on unregister - HID: split apart hid_device_probe to make logic more apparent - HID: ensure timely release of driver-allocated resources - HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling - HID: i2c-hid: Fix "(null)" output when reading report descriptor fails - HID: lg4ff: validate report length before fixed offsets - perf thread-stack: Fix heap buffer overflow on branch stack wrap copy - perf auxtrace: Fix queue grow overflow and old array leak - perf intel-pt: Fix off-by-one in auxtrace_info minimum size check - perf intel-bts: Fix off-by-one in auxtrace_info minimum size check - iio: light: tsl2772: fix ALS calibscale readback - iio: light: isl29028: return zero in write_raw() on success - iio: light: tsl2583: return zero in write_raw() on success - block/blk-stat: drain per-cpu callback stats over possible CPUs - block/blk-iocost: collect per-cpu latency stats over possible CPUs - block/kyber-iosched: flush per-cpu latency buckets over possible CPUs - lib/string: fix memchr_inv() for large ranges - pps: don't try to wait for negative timeouts in PPS_FETCH - PCI/sysfs: Add static PCI resource attribute macros - remoteproc: Add a rproc_set_firmware() API - remoteproc: Add new detach() remoteproc operation - remoteproc: Introduce function __rproc_detach() - remoteproc: Introduce function rproc_detach() - remoteproc: Fix various kernel-doc warnings - remoteproc: Move resource table data structure to its own header - remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources() - scripts/tags.sh: improve compiled sources generation - scripts/tags.sh: Prevent binary files appearing in cscope.files - ocfs2: use bitmap API in fill_node_map - drm/sun4i: vi scaler: Fix coefficient selection - of: property: add missing kerneldoc for of_graph_get_endpoint_count() - of: property: use unsigned int return on of_graph_get_endpoint_count() - bitfield: Add less-checking __FIELD_{GET,PREP}() - bitfield: Add non-constant field_{prep,get}() helpers - drm/sun4i: tcon: Drop remote endpoint reference - drm/sun4i: dw-hdmi: Drop TCON TOP port reference - drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz - RDMA/siw: Introduce siw_free_cm_id - arm64: hibernate: mask DAIF before restoring hibernated kernel - mfd: rave-sp: validate received frame payload lengths - mfd: iqs62x: Reject zero-length firmware records - drm/amdgpu/gfx6: Fixup emit_cntxcntl() - perf trace-event: Fix buffer overflow in read_string() - drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets - firmware_loader: Check fw_state_is_done in loading_store - pinctrl: rockchip: Reset the pin count when recalculating SoC data - regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling - sched/fair: Introduce a CPU capacity comparison helper - sched/fair: Check CPU capacity before comparing group types during load balance - Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855() - perf trace-event: Fix integer truncation in do_read() and skip() - iio: light: gp2ap002: re-enable irq if runtime suspend fails - arm64: dts: turris-mox: fix usb3 phys - ARM: dts: helios4: add vcc-supply to EEPROM - ARM: dts: helios4: add vcc-supply to GPIO expander - ARM: dts: helios4: add SATA regulator supplies - perf stat: Clear screen only if output file is a tty - perf stat: Fix evsel_list leak in cmd_stat - perf synthetic-events: Fix uninitialized pthread_join - perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads - iommu/vt-d: Fix UCTP context table slot when copying root entries - m68k: Fix backtraces for non-running tasks - powerpc/configs: enable CONFIG_RAS to fix EDAC support - spi: sprd-adi: Fix probe succeeding without registering the controller - nfc: digital: Do not dump a NULL response in command completion - dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal - ASoC: pxa: Use devm_clk_get_optional() for extclk clock - ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready - ubi: Fix repeated words in comments - ubi: fastmap: Use the bitmap API to allocate bitmaps - ubi: fastmap: Fix missed ec updating after erasing old fastmap data block - ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash - ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap - ubi: Replace erase_block() with sync_erase() - UBI: Preserve torture flag when rescheduling failed erasures - UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs - ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl - ubi: fastmap: Add fastmap control support for module parameter - ubi: Simplify bool conversion - ubi: fastmap: Wait until there are enough free PEBs before filling pools - ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs - ubi: fastmap: Add module parameter to control reserving filling pool PEBs - UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC - spi: img-spfi: don't disable runtime PM on DMA deferred probe - power: supply: bd99954: Drop bad register fields - power: supply: bq27xxx: bq27520g4: fix REG_TTES address - power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address - power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address - xenbus: Unregister reboot notifier on init failure - clocksource/drivers/clps711x: Do not unmap clocksource MMIO - clocksource/drivers/armada: Unwind timer clock on init failure - x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported - bpftool: Fix double close in map dump - ocfs2: fix circular locking dependency in ocfs2_init_acl() - bpf: Fix pending_pos walk on 32-bit ring position wrap - perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path() - perf dso: Guard against cache underflow on short reads in dso_cache__memcpy() - mailbox: rockchip: disable pclk on probe failure and unbind - hwmon: (emc1403) Add support for EMC1442 - NFS: Always clear an invalid mapping when attempting a buffered write - nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper - NFSv4/pnfs: Clean up layout get on open - nfs: refactor pNFS functions using clear_and_wake_up_bit - pppox: drain queued packets on channel handoff - hsr: Use a single struct for self_node. - net: hsr: Use full string description when opening HSR network device - net: bridge: vlan: fix inverted default vlan notification - ALSA: hda: Fix connection list comparison in proc output - 8139cp: fix Rx and Tx not being disabled in cp_suspend - vsock: use sock_error() to consume sk_err after a failed connect - bonding: initialize err for empty target lists - virtio_balloon: disable indirect descriptors - prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator - RDMA/ucma: Allow path records to exactly fit the output buffer - net: thunderbolt: Count delivered packets in rx_packets and rx_bytes - forcedeth: stop the tx_timeout register dump past the requested window - nfs: move the nfs4_data_server_cache into struct nfs_net - scsi: qla2xxx: Fix an loop timeout test - Bluetooth: compute LE flow credits based on recvbuf space - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister - Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX - cifs: fix clearing stats for fastest execution of each smb2 command - net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict() - net_sched: sch_fq: struct sched_data reorg - net_sched: sch_fq: change how @inactive is tracked - net_sched: export pfifo_fast prio2band[] - net/sched: sch_codel: clamp default mtu to avoid disabling CoDel - tpm: st33zp24: Validate locality read result - apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init - apparmor: policy_int make sure list heads are initialized before fail path - net: ethernet: sun4i-emac: Fix IRQ error handling - netfilter: xt_cgroup: Make it independent from net_cls - netfilter: xt_HL: add pr_fmt and checkentry validation - netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited() - selftests/arm64: Treat KSM merge_across_nodes as optional - net: stmmac: selftests: Check multiple MMC counters - net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering - net: stmmac: dwmac4: Account for the primary MAC address for UC filtering - net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering - net: stmmac: selftests: Account for the UC filter list for filtering tests - driver core: platform: don't oops in platform_shutdown() on unbound devices - crypto: ecdh - extend 'cra_driver_name' with curve name - crypto: ecdh - fix 'ecdh_init' - crypto: ecdh - fix ecdh-nist-p192's entry in testmgr - crypto: testmgr - fix initialization of 'secret_size' - clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled - mm/highmem: Take kmap_high_get() properly into account - ACPI: utils: Document for_each_acpi_dev_match() macro - HID: fix an error code in hid_check_device_match() - Bluetooth: L2CAP: Fix send LE flow credits in ACL link - Linux 5.10.270

0 tuxcare-debian11-els bpftool_5.10.270-1+tuxcare.els1_amd64.deb 0243a3c9e274aa173dbd1a95db3eac35c7aa5af4 hyperv-daemons_5.10.270-1+tuxcare.els1_amd64.deb e722b18affab2071d3e5d517bd778721bd69386a libcpupower-dev_5.10.270-1+tuxcare.els1_amd64.deb 1885902bd9bbe0fc808d050102c35ad92d8c2e34 libcpupower1_5.10.270-1+tuxcare.els1_amd64.deb e5b5bcafcbdd208a44054ee534f5244faf018c69 linux-compiler-gcc-10-x86_5.10.270-1+tuxcare.els1_amd64.deb 98671c01a71162e5a5e4ded1306d1cf48942f72b linux-config-5.10_5.10.270-1+tuxcare.els1_amd64.deb a96f02f412d9faf76c3f19d614ac363d6a54ed0d linux-cpupower_5.10.270-1+tuxcare.els1_amd64.deb b0a27f76b56906d31bf2c47a209b2bc010d25d00 linux-doc_5.10.270-1+tuxcare.els1_all.deb a11e25059d338848ffe6761808b89fdb880dc3e8 linux-doc-5.10_5.10.270-1+tuxcare.els1_all.deb 5ad8b6e6d3aeba718b4e58bad67dd97bac8a1dca linux-headers-5.10.0-49-amd64_5.10.270-1+tuxcare.els1_amd64.deb 13979d7d2b5c38859489bf1b7abdd80679493dec linux-headers-5.10.0-49-common_5.10.270-1+tuxcare.els1_all.deb 9ca77124354d21e7cf4a2203dbf2e3c1a851f811 linux-headers-amd64_5.10.270-1+tuxcare.els1_amd64.deb a766a0def40d07eb6b58640b4688e33ebc3bcbfd linux-image-5.10.0-49-amd64-unsigned_5.10.270-1+tuxcare.els1_amd64.deb 77d42a14970ddcf84f2869ee9e066bc78e040039 linux-image-amd64_5.10.270-1+tuxcare.els1_amd64.deb cf2b6a3a5e886aed878bfd848a011becc5f39cca linux-image-amd64-signed-template_5.10.270-1+tuxcare.els1_amd64.deb 57a6dab3f3f6c784714b47d59e8acb5ba4950577 linux-kbuild-5.10_5.10.270-1+tuxcare.els1_amd64.deb e60e8c416f07a3895df156de186d0fefa467ba5b linux-libc-dev_5.10.270-1+tuxcare.els1_amd64.deb 7c7608022ee112e26db4bfea7635ff42b3f40b8d linux-perf_5.10.270-1+tuxcare.els1_amd64.deb fbc3c4ad7e4cbc8cf41db189f1b1e473ae7df86f linux-perf-5.10_5.10.270-1+tuxcare.els1_amd64.deb 2e0e8f8eef11852ae3082df69b52d519e09b129a linux-source_5.10.270-1+tuxcare.els1_all.deb 9fa25d2e9bb21fbc6070182e05e9b47067560ac5 linux-source-5.10_5.10.270-1+tuxcare.els1_all.deb c594eabd2d17e0c4b93211c419b2bb90139f4854 linux-support-5.10.0-49_5.10.270-1+tuxcare.els1_all.deb 81e818465daeb5d5a28c7c955f14c83a9e8fd835 bpftool_5.10.270-1+tuxcare.els1_arm64.deb d06a20869f1c88106438e3fca9c4254b41596a31 hyperv-daemons_5.10.270-1+tuxcare.els1_arm64.deb 9e09188b913f37a8aa962940054a06ecca15c0d7 libcpupower-dev_5.10.270-1+tuxcare.els1_arm64.deb 0ec8873dd9ef0c93c91f100e3a6bb3fece835c8f libcpupower1_5.10.270-1+tuxcare.els1_arm64.deb fcdd6f6551bf82815b5039b3fe3420083df1334b linux-config-5.10_5.10.270-1+tuxcare.els1_arm64.deb b200f83ed7bb789e3ce9641433863a3b63917784 linux-cpupower_5.10.270-1+tuxcare.els1_arm64.deb 5c855dd93f618318d4c6c992b33f37654d5bbced linux-headers-5.10.0-49-arm64_5.10.270-1+tuxcare.els1_arm64.deb 4e7234c2cd4fb04458cf102e4f9d97e1f370f6f7 linux-headers-arm64_5.10.270-1+tuxcare.els1_arm64.deb bcbdd530674949bc6ec645b8fb02efb92055ca58 linux-image-5.10.0-49-arm64-unsigned_5.10.270-1+tuxcare.els1_arm64.deb 4e3455a0987b7694429ff120580110fc7055cdde linux-image-arm64_5.10.270-1+tuxcare.els1_arm64.deb 77e65aaa4b9d8de028862940db8bd2f1d403766c linux-image-arm64-signed-template_5.10.270-1+tuxcare.els1_arm64.deb 2cc9b87dc830bab206e83a6bcefc2e8f8088ee9c linux-kbuild-5.10_5.10.270-1+tuxcare.els1_arm64.deb a095b0c5c845fd81d0c3f7bcb325e15b2dedcbb9 linux-libc-dev_5.10.270-1+tuxcare.els1_arm64.deb 1b084cb1d3915ee414c02b30e1b61cb538cec645 linux-perf_5.10.270-1+tuxcare.els1_arm64.deb 660414131c8baca50922386312a80a7829656626 linux-perf-5.10_5.10.270-1+tuxcare.els1_arm64.deb 9c4cfd45cb465ccdb18b6d23951dea95f3a8df3a bpftool_5.10.270-1+tuxcare.els1_armel.deb 324fed9e4ab312772354224e08bb191af49c3fda libcpupower-dev_5.10.270-1+tuxcare.els1_armel.deb cdd8feadb67bb4f76e3775f076199707e56cf4f5 libcpupower1_5.10.270-1+tuxcare.els1_armel.deb 33bcd486742afe2c9baf6a6e96542e65637c721b linux-compiler-gcc-10-arm_5.10.270-1+tuxcare.els1_armel.deb a5405f0290caf0ed8181871b0c0419a53c26568b linux-config-5.10_5.10.270-1+tuxcare.els1_armel.deb 27cda179841eb1c29d5a3f815700324f0274f90a linux-cpupower_5.10.270-1+tuxcare.els1_armel.deb 461f737825480389bd4e0f5153a72fa09e217176 linux-headers-5.10.0-49-marvell_5.10.270-1+tuxcare.els1_armel.deb e84a3e7ebeeda576066ac9759ca24c7e3c529185 linux-headers-5.10.0-49-rpi_5.10.270-1+tuxcare.els1_armel.deb a72553c6e7aa6106f30f91ba71dadd880c6a39a5 linux-headers-marvell_5.10.270-1+tuxcare.els1_armel.deb 7074e22f2244cd0a17edd169dab7a5ca35a00c5f linux-headers-rpi_5.10.270-1+tuxcare.els1_armel.deb 066339676fbd758c817d41e93b1307de537a71f8 linux-image-5.10.0-49-marvell_5.10.270-1+tuxcare.els1_armel.deb 0d7ed8c750e0a6a67c168ee4c24c7a5b95a98447 linux-image-5.10.0-49-rpi_5.10.270-1+tuxcare.els1_armel.deb 5d8ed5d4de29673cdd9f968968ea35a2096f513d linux-image-marvell_5.10.270-1+tuxcare.els1_armel.deb 0cd464b9b412e6db2d861990adb0b88354bb0dcc linux-image-rpi_5.10.270-1+tuxcare.els1_armel.deb 93a2e06ace9288e91417581defdb67ffd696c971 linux-kbuild-5.10_5.10.270-1+tuxcare.els1_armel.deb 0b7c07825123fb7f98dda86ba0464698f71a5340 linux-libc-dev_5.10.270-1+tuxcare.els1_armel.deb 434b18f2d3c4071fb9843d7e7d9a9bc69ae77926 linux-perf_5.10.270-1+tuxcare.els1_armel.deb db25480e334da4984b151b57d6b26c495f0fd2cb linux-perf-5.10_5.10.270-1+tuxcare.els1_armel.deb a8a522d29003c2e8dba0c2cd682ad776918d0939 CLSA-2026:1792418429 TuxCare License Agreement 0 * Update to upstream stable Linux 5.10.272 (from 5.10.271). * Bump kernel ABI to 51: ship the ELS kernel as 5.10.0-51-*, distinct from the prior 5.10.0-50. * CVE-2021-47200 - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap {CVE-2021-47200} * CVE-2022-50000 - netfilter: flowtable: fix stuck flows on cleanup due to pending work {CVE-2022-50000} * CVE-2023-53111 - loop: Fix use-after-free issues {CVE-2023-53111} * CVE-2023-53577 - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} * CVE-2024-35864 - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864} * CVE-2024-35939 - dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} * CVE-2024-41013 - xfs: don't walk off the end of a directory data block {CVE-2024-41013} * CVE-2024-44934 - net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934} * CVE-2024-50063 - bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063} * CVE-2024-53095 - net: make sock_inuse_add() available {CVE-2024-53095} - smb: client: Fix use-after-free of network namespace. {CVE-2024-53095} * CVE-2024-53168 - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168} * CVE-2025-39797 - xfrm: Duplicate SPI Handling {CVE-2025-39797} * CVE-2025-39965 - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965} * CVE-2025-40075 - net: dst: introduce dst->dev_rcu {CVE-2025-40075} - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075} * CVE-2025-68188 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} * CVE-2026-31527 - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} * CVE-2026-43329 - netfilter: flowtable: separate replace, destroy and stats to different workqueues {CVE-2026-43329} - netfilter: flowtable: pass flowtable to nf_flow_table_iterate() {CVE-2026-43329} - netfilter: flowtable: add function to invoke garbage collection immediately {CVE-2026-43329} - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329} * CVE-2026-46119 - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} * CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} * CVE-2026-52956 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} * CVE-2026-53091 - net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091} - xfrm: Don't clobber inner headers when already set {CVE-2026-53091} * CVE-2026-53120 - PCI: use generic driver_override infrastructure {CVE-2026-53120} * CVE-2026-53131 - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} * CVE-2026-64109 - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} * CVE-2026-64424 - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} * CVE-2026-68399 - bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399} * CVE-2026-68426 - xfrm: fix stale skb->prev after async crypto steals a GSO segment {CVE-2026-68426} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2026-74289 - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89564 - ip: orphan prefetched skbs before multicast forwarding {CVE-2026-89564} * CVE-2026-90111 - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} * CVE-2026-98364 - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} * CVE-2026-98432 - ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432} * CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * Miscellaneous upstream changes - netfilter: nfnetlink_queue: unbreak SCTP traffic - Linux 5.10.272 - driver core: generalize driver_override in struct device - hwmon: axi-fan: don't use driver_override as IRQ name - netfilter: nf_tables: fix bidirectional offload regression Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Update to upstream stable Linux 5.10.272 (from 5.10.271). * Bump kernel ABI to 51: ship the ELS kernel as 5.10.0-51-*, distinct from the prior 5.10.0-50. * CVE-2021-47200 - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap {CVE-2021-47200} * CVE-2022-50000 - netfilter: flowtable: fix stuck flows on cleanup due to pending work {CVE-2022-50000} * CVE-2023-53111 - loop: Fix use-after-free issues {CVE-2023-53111} * CVE-2023-53577 - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} * CVE-2024-35864 - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864} * CVE-2024-35939 - dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939} * CVE-2024-41013 - xfs: don't walk off the end of a directory data block {CVE-2024-41013} * CVE-2024-44934 - net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934} * CVE-2024-50063 - bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063} * CVE-2024-53095 - net: make sock_inuse_add() available {CVE-2024-53095} - smb: client: Fix use-after-free of network namespace. {CVE-2024-53095} * CVE-2024-53168 - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168} * CVE-2025-39797 - xfrm: Duplicate SPI Handling {CVE-2025-39797} * CVE-2025-39965 - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965} * CVE-2025-40075 - net: dst: introduce dst->dev_rcu {CVE-2025-40075} - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075} * CVE-2025-68188 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} * CVE-2026-31527 - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} * CVE-2026-43329 - netfilter: flowtable: separate replace, destroy and stats to different workqueues {CVE-2026-43329} - netfilter: flowtable: pass flowtable to nf_flow_table_iterate() {CVE-2026-43329} - netfilter: flowtable: add function to invoke garbage collection immediately {CVE-2026-43329} - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329} * CVE-2026-46119 - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} * CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} * CVE-2026-52956 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} * CVE-2026-53091 - net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091} - xfrm: Don't clobber inner headers when already set {CVE-2026-53091} * CVE-2026-53120 - PCI: use generic driver_override infrastructure {CVE-2026-53120} * CVE-2026-53131 - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} * CVE-2026-64109 - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} * CVE-2026-64424 - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} * CVE-2026-68399 - bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399} * CVE-2026-68426 - xfrm: fix stale skb->prev after async crypto steals a GSO segment {CVE-2026-68426} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2026-74289 - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89564 - ip: orphan prefetched skbs before multicast forwarding {CVE-2026-89564} * CVE-2026-90111 - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} * CVE-2026-98364 - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} * CVE-2026-98432 - ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432} * CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * Miscellaneous upstream changes - netfilter: nfnetlink_queue: unbreak SCTP traffic - Linux 5.10.272 - driver core: generalize driver_override in struct device - hwmon: axi-fan: don't use driver_override as IRQ name - netfilter: nf_tables: fix bidirectional offload regression

0 tuxcare-debian11-els bpftool_5.10.272-1+tuxcare.els1_amd64.deb c6c72e0f61a5ea9e417485ab9f4bd98b2426af83 hyperv-daemons_5.10.272-1+tuxcare.els1_amd64.deb 9fbf13e38ba12fe151f377754806ad3bd9e71848 libcpupower-dev_5.10.272-1+tuxcare.els1_amd64.deb c42b9597b593e3d2b3ce15b2b93cc639bab617a3 libcpupower1_5.10.272-1+tuxcare.els1_amd64.deb 336c29f2ccb444c8159fc4cc73feb81eee5bb570 linux-compiler-gcc-10-x86_5.10.272-1+tuxcare.els1_amd64.deb 409e290f079b37c90bb496132d0f7eb45a861f71 linux-config-5.10_5.10.272-1+tuxcare.els1_amd64.deb a7706a43fa28ca4f986bc88a02bc3adc46117ea7 linux-cpupower_5.10.272-1+tuxcare.els1_amd64.deb 8006e5268af257bea262d3a3319d01e107d6f085 linux-doc_5.10.272-1+tuxcare.els1_all.deb 581dc6d3b2a3d15470ada78a5ae5c2abc853a363 linux-doc-5.10_5.10.272-1+tuxcare.els1_all.deb 2e1b1c90ecb09a9611675645e377db138c584a5d linux-headers-5.10.0-51-amd64_5.10.272-1+tuxcare.els1_amd64.deb 42c26806fa13f1bbcd632f7e18b9f081285176c7 linux-headers-5.10.0-51-common_5.10.272-1+tuxcare.els1_all.deb fabd4aa6df1accb599cb39d9b1712dd457c32148 linux-headers-amd64_5.10.272-1+tuxcare.els1_amd64.deb dd1df475c658971d5e60d3e70b4a8483d0962cf7 linux-image-5.10.0-51-amd64-unsigned_5.10.272-1+tuxcare.els1_amd64.deb a9acaae9c89fa94e28abafcd6bee193035f12fa9 linux-image-amd64_5.10.272-1+tuxcare.els1_amd64.deb 5887eb78506be9fb9752169cce457917f7bb6672 linux-image-amd64-signed-template_5.10.272-1+tuxcare.els1_amd64.deb 98974c278474afca440be42cb3c896f6a9a87970 linux-kbuild-5.10_5.10.272-1+tuxcare.els1_amd64.deb ac95cf45ef42691c18bfcda741b3055f0610cb9b linux-libc-dev_5.10.272-1+tuxcare.els1_amd64.deb 1685c57fb13f8a3f841a0b27d1b0325bf8dd8d0a linux-perf_5.10.272-1+tuxcare.els1_amd64.deb 321c6753658aa4743640fec918697fafa20168a8 linux-perf-5.10_5.10.272-1+tuxcare.els1_amd64.deb e8bb9ae5cefdc640c65f554ff88545f791f1a600 linux-source_5.10.272-1+tuxcare.els1_all.deb 0851d7ab9ffd0444086a0615269e41f3a281c357 linux-source-5.10_5.10.272-1+tuxcare.els1_all.deb b3e58da15ae5f07c6d66233219279a893c9dd8a8 linux-support-5.10.0-51_5.10.272-1+tuxcare.els1_all.deb 2817b51f76399919f559ec502630be3407296a15 bpftool_5.10.272-1+tuxcare.els1_arm64.deb 1e0bbeb4380dc96791a8a0bea7a4d4599290f04d hyperv-daemons_5.10.272-1+tuxcare.els1_arm64.deb ef10e3030aaa0231db5308f62a4ce76c34dc08f9 libcpupower-dev_5.10.272-1+tuxcare.els1_arm64.deb a3774a3a91e35b43e435e36d958085b69ae8115e libcpupower1_5.10.272-1+tuxcare.els1_arm64.deb ba4a844047f746febf2196967ceea7de172a77bd linux-config-5.10_5.10.272-1+tuxcare.els1_arm64.deb d700fd3ab2b7a78b7eb132edde58da611aabab2e linux-cpupower_5.10.272-1+tuxcare.els1_arm64.deb 67424473b2ad2078a7eea17097cc271d6b079738 linux-headers-5.10.0-51-arm64_5.10.272-1+tuxcare.els1_arm64.deb b1a668fecb6571fd28680c1addcfd9c50a16d6d2 linux-headers-arm64_5.10.272-1+tuxcare.els1_arm64.deb 0c11e93ae6fc69c4caacccb78f6810f8e6d5e77a linux-image-5.10.0-51-arm64-unsigned_5.10.272-1+tuxcare.els1_arm64.deb 35ba1c7fd4a529cedea37e7a8a45488d503e415c linux-image-arm64_5.10.272-1+tuxcare.els1_arm64.deb 52932bd7e2c450c8ba64b8fef596625aae0e2a00 linux-image-arm64-signed-template_5.10.272-1+tuxcare.els1_arm64.deb 91a4ad68032db4eab2963ad8e5eae283c7e83af0 linux-kbuild-5.10_5.10.272-1+tuxcare.els1_arm64.deb 8db74cbdc2955f09a71b397c81c4703d95a30cfb linux-libc-dev_5.10.272-1+tuxcare.els1_arm64.deb 715a062e07ba8b49c6e8234ec20e9af2f3b64dcd linux-perf_5.10.272-1+tuxcare.els1_arm64.deb 7b3d95126ff1d3dfe3fa01fc96d0d0cd1522caed linux-perf-5.10_5.10.272-1+tuxcare.els1_arm64.deb 064f9d132de90236e791cc8de0658e736a5fd02e bpftool_5.10.272-1+tuxcare.els1_armel.deb 3b9379bdbc4abb6c117873cdc799ef59c623673d libcpupower-dev_5.10.272-1+tuxcare.els1_armel.deb e545cac68af7ab606538d176fbce3d98d388072c libcpupower1_5.10.272-1+tuxcare.els1_armel.deb ace7ab9737b72cd89e41a46ddc83c25991408856 linux-compiler-gcc-10-arm_5.10.272-1+tuxcare.els1_armel.deb ca92c3596c5620c0214b01281d1930337256a2ab linux-config-5.10_5.10.272-1+tuxcare.els1_armel.deb f64bce3edba92dd136604c93b231314d08ec5aff linux-cpupower_5.10.272-1+tuxcare.els1_armel.deb 222d979ce4fdb224ba850b951ff7a4fb9911593c linux-headers-5.10.0-51-marvell_5.10.272-1+tuxcare.els1_armel.deb 1748afeb950929bc213cf38451ec1084f7f5014a linux-headers-5.10.0-51-rpi_5.10.272-1+tuxcare.els1_armel.deb afc99bca336990f58b8d5cf1b8b7c9ba62004a02 linux-headers-marvell_5.10.272-1+tuxcare.els1_armel.deb 074442e09f8b3f6a239782d8f7ade93336912b7e linux-headers-rpi_5.10.272-1+tuxcare.els1_armel.deb 06eecfe8b64932a82be6ee197e95429f80a37731 linux-image-5.10.0-51-marvell_5.10.272-1+tuxcare.els1_armel.deb c648dfa592091ebc3ec6935d927225991f177790 linux-image-5.10.0-51-rpi_5.10.272-1+tuxcare.els1_armel.deb 26256eeecbd67e9020485456d361ff10bd138b5b linux-image-marvell_5.10.272-1+tuxcare.els1_armel.deb adec4db52fb7afe59d45c4147aba4fd28a833418 linux-image-rpi_5.10.272-1+tuxcare.els1_armel.deb 5b2e16145241b1848009d519ef124df97acfeb5a linux-kbuild-5.10_5.10.272-1+tuxcare.els1_armel.deb 1872f1d3ef90157aaed715a8731ad93521991aa7 linux-libc-dev_5.10.272-1+tuxcare.els1_armel.deb 03bf1e622da3062ec7a513cc8b102c731c13621f linux-perf_5.10.272-1+tuxcare.els1_armel.deb 020ba84dd59b92c5ddd6b981f3d745fb55805914 linux-perf-5.10_5.10.272-1+tuxcare.els1_armel.deb 45000d2b87cca4430a3ddb64d8d266d6ff3d09cd CLSA-2026:1792483021 TuxCare License Agreement 0 * SECURITY UPDATE: Directory traversal in tarfile extraction - debian/patches/CVE-2007-4559.patch: make the PEP 706 extraction filters available for tarfile and shutil.unpack_archive, including the 'data' filter that rejects members escaping the destination directory. The filters are opt-in and the default extraction behaviour is unchanged (still 'fully_trusted', i.e. no filtering), matching upstream Python 3.9. Callers must opt in explicitly, via tar.extractall(path, filter='data') per call, TarFile.extraction_filter = tarfile.data_filter process-wide, or shutil.unpack_archive(..., filter='data'); include the upstream gh-135034 through gh-157265 rollups so the opt-in filters normalize link targets, re-filter link fallbacks and directory fixups, skip rejected members when errorlevel is zero, and resolve hardlink targets. - CVE-2007-4559 - CVE-2024-12718 - CVE-2025-4138 - CVE-2025-4330 - CVE-2025-4435 - CVE-2025-4517 - CVE-2026-4360 - CVE-2026-7774 - CVE-2026-11940 - CVE-2026-19672 - CVE-2026-82049 - CVE-2026-87910 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Directory traversal in tarfile extraction - debian/patches/CVE-2007-4559.patch: make the PEP 706 extraction filters available for tarfile and shutil.unpack_archive, including the 'data' filter that rejects members escaping the destination directory. The filters are opt-in and the default extraction behaviour is unchanged (still 'fully_trusted', i.e. no filtering), matching upstream Python 3.9. Callers must opt in explicitly, via tar.extractall(path, filter='data') per call, TarFile.extraction_filter = tarfile.data_filter process-wide, or shutil.unpack_archive(..., filter='data'); include the upstream gh-135034 through gh-157265 rollups so the opt-in filters normalize link targets, re-filter link fallbacks and directory fixups, skip rejected members when errorlevel is zero, and resolve hardlink targets. - CVE-2007-4559 - CVE-2024-12718 - CVE-2025-4138 - CVE-2025-4330 - CVE-2025-4435 - CVE-2025-4517 - CVE-2026-4360 - CVE-2026-7774 - CVE-2026-11940 - CVE-2026-19672 - CVE-2026-82049 - CVE-2026-87910

0 tuxcare-debian11-els idle-python3.9_3.9.2-1+deb11u7+tuxcare.els4_all.deb c9eb1a260708b56366cdcbf189684d9856f0db5c libpython3.9_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 3e129761f4c6ebe58c909bf6948ae7269c0a94d9 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 74f5111d46fec80b11e1c5fcda14f15c642fba4f libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 6e0f7165e4746edb8e7f60cca2b832a1653c89d4 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 24ac50bac9dbc9092a35463a0bac6b22bc9a9da3 libpython3.9-testsuite_3.9.2-1+deb11u7+tuxcare.els4_all.deb 96602c07b8b21eeafe413dce31f4f70b69e217de python3.9_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 656e2c938bed92602c61a488209ce03b3adebbdc python3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb d8e983141fd117f3b294ddb15002201f672fed71 python3.9-doc_3.9.2-1+deb11u7+tuxcare.els4_all.deb 7f1d6f4f1c9c2b8c63f33864124c057327859c59 python3.9-examples_3.9.2-1+deb11u7+tuxcare.els4_all.deb bf1b6183dbca58dfd200161142440fa6378a2d74 python3.9-full_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 494912559aece6e8458ee3ca5a61b5f924d0bbf4 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 35df0d9aba44de6f3e594459eef8d10d33d92eab python3.9-venv_3.9.2-1+deb11u7+tuxcare.els4_amd64.deb 8c246c40b0e559f6662a4ba25ff614eeef15dfed libpython3.9_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 79e443cb8ac223882e6b90757e924b24e94e80c5 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb a3f0c8ee889f6bfa2e505a41b781a56fe89ce233 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 42b0f8a0d4878ff80a35263ca28cd449cadb74e7 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 12a874ac604feedac3f02f06bfe37e675387d2f8 python3.9_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 8d03ce10994e5be93df6e1fd8733835e3e3288ea python3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb cf20fb8b9c07bf77647a7e84518a109c79723e25 python3.9-full_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb a0105fed4627492b0365b7d860a75e429c096ee4 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 0c787a23393fdd7294de224761b98f4a5b5095bd python3.9-venv_3.9.2-1+deb11u7+tuxcare.els4_arm64.deb 97d98ce4401edef319403795570a61c0fbeb183f libpython3.9_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 3b34bafe4c0c7368efb7bfd3700652994cae2f41 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_armel.deb b5d33313ab824476be8eaf68a1ab5edc768f41ba libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_armel.deb a5c9776c16a5d0cccef6cc6611c3b133a94cc6e9 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 01ac2c02b9efb48714a9da2fb0c5e40002c7b31f python3.9_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 344d7fe8e606337fde22f4fb9803bace91db844f python3.9-dev_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 21cd1189332b94d984970a41581ec6fb167f52bf python3.9-full_3.9.2-1+deb11u7+tuxcare.els4_armel.deb d473ad1b03da25ae4ac8efc9b8e2342a67dd7a74 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 87609d60d708ba70f86b7b0081d7d6599f37bc62 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els4_armel.deb 8a3ced17c31e2bf2ae19badf1a00affd14475cd8 CLSA-2026:1792485017 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer over-read in HeifPixelImage::overlay() - debian/patches/CVE-2025-68431.patch: backport upstream 85e21ad (clip right/bottom border with int64 before left/top) and b8c12a7 (fix copy width for overlays placed past the left border) in heif_image.cc and heif_context.cc - CVE-2025-68431 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer over-read in HeifPixelImage::overlay() - debian/patches/CVE-2025-68431.patch: backport upstream 85e21ad (clip right/bottom border with int64 before left/top) and b8c12a7 (fix copy width for overlays placed past the left border) in heif_image.cc and heif_context.cc - CVE-2025-68431

0 tuxcare-debian11-els heif-gdk-pixbuf_1.11.0-1+deb11u2+tuxcare.els1_amd64.deb 69a3f3807855eb23437d5507a2161e109c1757d9 heif-thumbnailer_1.11.0-1+deb11u2+tuxcare.els1_amd64.deb 69d86c04cd97f5a4d47aecc089c1036d3804f321 libheif-dev_1.11.0-1+deb11u2+tuxcare.els1_amd64.deb 49fb8473a218bd351e3592f5dee5f3d57dda4a6f libheif-examples_1.11.0-1+deb11u2+tuxcare.els1_amd64.deb 431a8ee543b5caf55866f12bc6b12127ddf68b4e libheif1_1.11.0-1+deb11u2+tuxcare.els1_amd64.deb efe812b7679715c642a94c3bcc84fcc287335ba2 heif-gdk-pixbuf_1.11.0-1+deb11u2+tuxcare.els1_arm64.deb d2beb429ac79c49818b752db78a18bb39ebb8765 heif-thumbnailer_1.11.0-1+deb11u2+tuxcare.els1_arm64.deb 46be13180412eea483bb7268d08f2fc3abd06584 libheif-dev_1.11.0-1+deb11u2+tuxcare.els1_arm64.deb 61e17f3665e2f2ef9e086ec2593be84fdfbe72db libheif-examples_1.11.0-1+deb11u2+tuxcare.els1_arm64.deb b96bbb32189efa96c25d60b2d58bd013a4b0e2ab libheif1_1.11.0-1+deb11u2+tuxcare.els1_arm64.deb 4394926ba46d521398c65e60616d0236eb10a73c heif-gdk-pixbuf_1.11.0-1+deb11u2+tuxcare.els1_armel.deb 91e0204f2a4c6c90909d420b45555f713f439801 heif-thumbnailer_1.11.0-1+deb11u2+tuxcare.els1_armel.deb 0a345904c4ac915d6cf806bc3e09ad583e4a4e05 libheif-dev_1.11.0-1+deb11u2+tuxcare.els1_armel.deb dd710b092da492b2dd820802d1fa850f28be66c9 libheif-examples_1.11.0-1+deb11u2+tuxcare.els1_armel.deb b81550b52ed9bc1d0f3b5971ef51ef43ec1f6915 libheif1_1.11.0-1+deb11u2+tuxcare.els1_armel.deb 95685cf0b05b57021f16e079db5bf8be703bb9ef CLSA-2026:1792487084 TuxCare License Agreement 0 * SECURITY UPDATE: Infinite loop when seeking a truncated tar stream - debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in tarfile._Stream.seek() once the stream returns no more data - CVE-2026-11972 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Infinite loop when seeking a truncated tar stream - debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in tarfile._Stream.seek() once the stream returns no more data - CVE-2026-11972

0 tuxcare-debian11-els idle-python3.9_3.9.2-1+deb11u7+tuxcare.els3_all.deb 58d6d42e3ec1194704ba7de260d14200abc5bf01 libpython3.9_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 582f12f66228a85e9f37c3dde418d5cf6d61637b libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 9b37c4855f64fd4bf4ae743ded13a6a66aac0346 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 9886009a3aeecb812e69e52d7c9c4a4f653f1f3e libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 8cc7507019f3072e24a800e93ff17dba1dc090dc libpython3.9-testsuite_3.9.2-1+deb11u7+tuxcare.els3_all.deb 279a3a9fab2f78e58532d72411bdd22b9fb57c09 python3.9_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb fe510a329a59d72ba2fbbfdbf1b17e25a8f12994 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 7631383493f792b360980f2e6cebfc0d3a669585 python3.9-doc_3.9.2-1+deb11u7+tuxcare.els3_all.deb d364e293275306cf70ed9ed525b9353938414a94 python3.9-examples_3.9.2-1+deb11u7+tuxcare.els3_all.deb fd6716c602f58422d04019e8a00a3cc07673e61b python3.9-full_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb 12598393ab48b3ec68b6df86319b1a7c38044f08 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb eef7205d782268b48acd985fe052f07a1cf49584 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els3_amd64.deb d68ccd800ddd5107b109c02bbbdd60310b5c067f libpython3.9_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb a68acd0981ba0fd41babdb7b5a5e4355ad84cae2 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb 95ac16990c3f7866efddd1a68ca2e43aa722036b libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb 61c971f0f7ef4543c8cb564894e406a3859adbe7 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb 1329e9204033e8c52a8b078f224509090b4e2d2f python3.9_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb ba80669aa2d3ebafd48e7d49540f487626bd59a8 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb a725f7f9ae5489093766310510a9b1afea02d8e7 python3.9-full_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb 14d02eac939620e5e518760e0443685537d43f89 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb 5fc95d227f6701822afe72bf4657166b39f428db python3.9-venv_3.9.2-1+deb11u7+tuxcare.els3_arm64.deb cf234aea688c9bf44eb9fdde5525945a3adbc967 libpython3.9_3.9.2-1+deb11u7+tuxcare.els3_armel.deb bcaaf7275d693982b96c075a921700b3c5991b85 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_armel.deb 67cf34293b465383776b69a8048bbd289f2e1093 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_armel.deb c9a87c2eb917e49d81f4058f707952db5388d5f5 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els3_armel.deb b7ea6bf74cf414fe0588e933bf77c5e15d395579 python3.9_3.9.2-1+deb11u7+tuxcare.els3_armel.deb b8c6f0bb89acdb88c1bbaa8342ef38dc5f91dc24 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els3_armel.deb aa2763b5b98ab74735c5694d79a31fba19e9b4fd python3.9-full_3.9.2-1+deb11u7+tuxcare.els3_armel.deb 2d15c319eb305688057e7ba8a3ebbc302dbc95b1 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els3_armel.deb 74c7bbc0ff1cd30b5e3595da5d98823bf19ded72 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els3_armel.deb ea9d31c71764e149731b4bca98913105d0d1fb11 CLSA-2026:1792508142 TuxCare License Agreement 0 * SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char - debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char - CVE-2026-56153 * SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - CVE-2026-46729 * SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables - debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables - CVE-2026-56154 * SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content - debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content - CVE-2026-56449 * SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header - debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header - CVE-2026-63292 * SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - CVE-2026-63718 * SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy - debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy - CVE-2026-57941 * SECURITY UPDATE: mod_xml2enc: NULL pointer dereference on charset conversion failure - debian/patches/CVE-2026-63686.patch: mod_xml2enc: NULL pointer dereference on charset conversion failure - CVE-2026-63686 * SECURITY UPDATE: mod_auth_digest: digest authentication replay - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: digest authentication replay - CVE-2026-73636 * SECURITY UPDATE: mod_auth_digest: use-after-free of client entry - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: use-after-free of client entry - CVE-2026-73637 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: mod_charset_lite: heap overflow in finish_partial_char - debian/patches/CVE-2026-56153.patch: mod_charset_lite: heap overflow in finish_partial_char - CVE-2026-56153 * SECURITY UPDATE: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - debian/patches/CVE-2026-46729.patch: mod_heartmonitor: NULL pointer dereference on malformed heartbeat - CVE-2026-46729 * SECURITY UPDATE: mod_rewrite: use-after-free via LA-U lookahead variables - debian/patches/CVE-2026-56154.patch: mod_rewrite: use-after-free via LA-U lookahead variables - CVE-2026-56154 * SECURITY UPDATE: mod_proxy_html: out-of-bounds write in dump_content - debian/patches/CVE-2026-56449.patch: mod_proxy_html: out-of-bounds write in dump_content - CVE-2026-56449 * SECURITY UPDATE: mod_vhost_alias: stack overflow with oversized Host header - debian/patches/CVE-2026-63292.patch: mod_vhost_alias: stack overflow with oversized Host header - CVE-2026-63292 * SECURITY UPDATE: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - debian/patches/CVE-2026-63718.patch: mod_proxy_uwsgi: response smuggling via Transfer-Encoding - CVE-2026-63718 * SECURITY UPDATE: mod_http2: use-after-free via shared session bbtmp re-entrancy - debian/patches/CVE-2026-57941.patch: mod_http2: use-after-free via shared session bbtmp re-entrancy - CVE-2026-57941 * SECURITY UPDATE: mod_xml2enc: NULL pointer dereference on charset conversion failure - debian/patches/CVE-2026-63686.patch: mod_xml2enc: NULL pointer dereference on charset conversion failure - CVE-2026-63686 * SECURITY UPDATE: mod_auth_digest: digest authentication replay - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: digest authentication replay - CVE-2026-73636 * SECURITY UPDATE: mod_auth_digest: use-after-free of client entry - debian/patches/CVE-2026-73636_CVE-2026-73637.patch: mod_auth_digest: use-after-free of client entry - CVE-2026-73637

0 tuxcare-debian11-els apache2_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb bed08250dfd909ebd84906621380d7d18a1c5cbd apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb 7b5065a3950ee11e7b06de63fd2a188b43f4c870 apache2-data_2.4.67-1~deb11u3+tuxcare.els1_all.deb 7197dc09a85e336f84cfb803d75e41370d173c1a apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb f8d053deda8ecd26d1d5bbab171a8f694daa7e80 apache2-doc_2.4.67-1~deb11u3+tuxcare.els1_all.deb 1b0e3cec9815efc638bad5ca6b3fe132d86ba740 apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb 1d835ad5ced7f11d9d1c48ec120b209e821fb1bb apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb d5efbddb5a947f6c31e220a1410cf0b140aed171 apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb 08507e2d29ae73d640b00a5342469382de244286 apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb a3d5ae270f5df54ef5ec8ab1420d60a0ecffd656 libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb 080b0cab9aa054bb3b312358e001d2e24e81d802 libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_amd64.deb b36a83f4f296e292cf09ce8e677ac36231906b45 apache2_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb f9d991bc43b225527c1f7200770d20c2bcc4899b apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 00e488be7604420e960cf3a230fe1dbb658e34ee apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb ed7aec188ef2c79fbd96740b9ad61f2ec0768c09 apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb ab10a472f19029c7f7202cf882c2abb46c26a295 apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 7f982774fe7960b8500b27bd839616e4947828bf apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 9652b86e8e0ee9b4e395126a59b1a2d7cb3eb7c6 apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 5a3b40c251f4173aee23d55eb27e0ada8b0720ba libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 66a77336df3264db7a599a3073905204c3a527a8 libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_arm64.deb 27f661127af82eb3b1bfc10d5f080d4657cec969 apache2_2.4.67-1~deb11u3+tuxcare.els1_armel.deb 0f568f640431a8fa5b4e9179e0143784d7273ace apache2-bin_2.4.67-1~deb11u3+tuxcare.els1_armel.deb becb8f0e13dbe6c0e31c82a5a1932ce0f7228698 apache2-dev_2.4.67-1~deb11u3+tuxcare.els1_armel.deb 6f266e8d27def8becf60a1dc65bea9232c9922ab apache2-ssl-dev_2.4.67-1~deb11u3+tuxcare.els1_armel.deb b1c59920341b8a3060f96059b00895606f7e3549 apache2-suexec-custom_2.4.67-1~deb11u3+tuxcare.els1_armel.deb 8c662e8626a327cf7f38aea340ceb00a5eafa23d apache2-suexec-pristine_2.4.67-1~deb11u3+tuxcare.els1_armel.deb b61bb9b741fcefceb83fa4ed9a0f2ea8c7fb2b79 apache2-utils_2.4.67-1~deb11u3+tuxcare.els1_armel.deb 0db70b3ec09b8a8352183cfe8f0062259c8709df libapache2-mod-md_2.4.67-1~deb11u3+tuxcare.els1_armel.deb 9f417cd9d671d995318d13b2ca8b56455cbe49a6 libapache2-mod-proxy-uwsgi_2.4.67-1~deb11u3+tuxcare.els1_armel.deb b1be10c69a3c13d8ab94059ccabade3e7bd58074 CLSA-2026:1792575875 TuxCare License Agreement 0 * SECURITY UPDATE: Use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, resolve the SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to that context and to the callback while they are in use, and unregister the callback in context_dealloc(), so a client can no longer make the server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream ec44b5a3258c (gh-156293, GH-158504); Py_NewRef() and Py_XNewRef() become Py_INCREF() and Py_XINCREF(), which is what 3.9 provides, and the context_dealloc() unregister is wrapped in this branch's HAVE_SNI guard. Includes the upstream regression tests, which apply unchanged - CVE-2026-19445 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Use-after-free in the SSL servername (SNI) callback - debian/patches/CVE-2026-19445.patch: in Modules/_ssl.c, resolve the SSLContext from the connection instead of the borrowed pointer registered with OpenSSL, hold strong references to that context and to the callback while they are in use, and unregister the callback in context_dealloc(), so a client can no longer make the server call through a freed SSLContext after sni_callback switched the connection to another context. Backport of upstream ec44b5a3258c (gh-156293, GH-158504); Py_NewRef() and Py_XNewRef() become Py_INCREF() and Py_XINCREF(), which is what 3.9 provides, and the context_dealloc() unregister is wrapped in this branch's HAVE_SNI guard. Includes the upstream regression tests, which apply unchanged - CVE-2026-19445

0 tuxcare-debian11-els idle-python3.9_3.9.2-1+deb11u7+tuxcare.els5_all.deb 8d2c74fcbdab8e6bf2f98600f3462e2d16b90e5c libpython3.9_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb ca458e79fb539707e760fc7f174a07579a3a5dce libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 1870f9122215f0dbd841c387636dc1e63fb883e9 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 358f58e512a3bad00f0172f2f0fa5670552df5e0 libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 2fbd5ea3714e482fb2bb6a7046aa3ea45c0fbd4c libpython3.9-testsuite_3.9.2-1+deb11u7+tuxcare.els5_all.deb 67ca20fd09b5869d88f3291a50647976a416863f python3.9_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 1c67b7e113469ee6a36a1f69f434fe9f8659fc43 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb b1d8f1012e632a9bd18f9d0fa8411a871fdaf8ef python3.9-doc_3.9.2-1+deb11u7+tuxcare.els5_all.deb afb3400b242e9de9f6f4dd9ac2925e34fdf35267 python3.9-examples_3.9.2-1+deb11u7+tuxcare.els5_all.deb 0c566c7af1ffb3472a7a5aa8cae1594144993d76 python3.9-full_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 2d8dfd057a02b3649bd1e1572c1a05749c39e6f2 python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 0167f470d0354897b2907383d63235f6805a7802 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els5_amd64.deb 0440038718b6c3594bc5e59d5467a42c9ac1ac2a libpython3.9_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb a715cdbd3f39b65442aa7941d50916ab1f1724b0 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 5f607a318569b4baa7a9329004cb72662abf2dd2 libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb a10dbe4cb44cdd72d8ea36cce73e2171035cddae libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 8c47405d9c42d9d73e3803fda6cfbcf2ec0e515b python3.9_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb cf994ae566b8cfba356393a0dfc18ed50286453b python3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 676706ecaf70f15bd69fa7bd5c121beb8d61ae68 python3.9-full_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 3c5000c17a2ad919bfcf6440ac573e99f74c60ad python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 915c58fb95c13c91fc6451560d566991b186d5e4 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els5_arm64.deb 950e7b622ac42daf3b2d26907d8e2da9a8302740 libpython3.9_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 6e96e90dd6b7f1eeb56e1de6362a79ddb823b222 libpython3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 6cddfef76377d2a8e525a18b0f19f0ef977d21ce libpython3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 0240414d6660c3799fcf4dfc4f13b90d1a0b497b libpython3.9-stdlib_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 49ff44781e052c8063edf67236a89df84544091d python3.9_3.9.2-1+deb11u7+tuxcare.els5_armel.deb bff49b2bcc2165119aa50f2bd7b470c14b423a62 python3.9-dev_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 801f50dbb4aa394def17acac1b052bc48d1af67f python3.9-full_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 2aed40315aae5d4202d0a9e3ddb064c9b43c996e python3.9-minimal_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 7853252f1310bc9badaa677428f0631c37ef17a9 python3.9-venv_3.9.2-1+deb11u7+tuxcare.els5_armel.deb 80ba8f0b91b7e3d96a492e16c601178a6fa2415d CLSA-2026:1792612253 TuxCare License Agreement 0 * SECURITY UPDATE: state corruption via bailout during request handling - debian/patches/CVE-2026-109618-CVE-2026-109619.patch: terminate the process on allocation overflow instead of bailing out, reset request and executor state on shutdown, allocate request arrays minimally, keep only used multipart headers and disable session upload progress tracking - CVE-2026-109618 - CVE-2026-109619 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: state corruption via bailout during request handling - debian/patches/CVE-2026-109618-CVE-2026-109619.patch: terminate the process on allocation overflow instead of bailing out, reset request and executor state on shutdown, allocate request arrays minimally, keep only used multipart headers and disable session upload progress tracking - CVE-2026-109618 - CVE-2026-109619

0 tuxcare-debian11-els libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 6c935abd2c69f7d738eccf9e067ef50d74b82162 libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 0f0fc662dd6cc02d8798530bbe6de89bbfd42bbe php7.4_7.4.33-1+deb11u12+tuxcare.els2_all.deb 697eedbff36de35539c6c033b5a3c1e029ba173c php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 385b7fcbd12224e12888ef26c954b4337c880ad0 php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb ef7776c9f596ec7ae463b66c9bb4a9804feef2fc php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 14589410a5ed1b8a6bdbd0391659a3301e1ea7d8 php7.4-cli_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb eb1e179b6f3c3ace1cc997614982d8549671164a php7.4-common_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 607a3b37f8b344823f97cc520887c91d01e9b3e9 php7.4-curl_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb da10ecb30a3f6b7e74c9392c5afdcc990c62a884 php7.4-dba_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 8e1295b44b9c8f764b3a7f500f7ca09691e9ed84 php7.4-dev_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb db16b601bd3bdb5c9acf1c2276d6060a10a4ddcc php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 7b06affaac8f64b540f70edfdf005f6bba1105d7 php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb d697926704d99fb16a45589b7106ab0be13eb76b php7.4-gd_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 4e216d1c38b2aa5954f8c75fe61996da078b7445 php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 3bca379180f2d68f0d0f94c906685081d36c89e1 php7.4-imap_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 9bdbecbccf0ee0d46eaed8fb3780e9a488927154 php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb fc94fe986d5baa935a5126da66691c5fd35eb986 php7.4-intl_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 408d720bc08ec2dd33fdc0263c9763db0f6b675e php7.4-json_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb d4bf6fad27f051e8246a81536ff78f8b6f9083f6 php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 454dc3287894327066a2860feddc3b82b5fdc453 php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 4bf6374435cb9eb4b56ecfbbe4aab30c50c6e796 php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 0de2a015fd85b551db9b9e1a5d784493fce4e9fd php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 600c62ae8bde862e6deff692d2118e13d59e7725 php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb a7e5a583b4574986f6737fac76b51a90717db26c php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb bde5fae4733fda3fd9e7d1437f00045d954f2535 php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 7eb2fc5dc5a46f25e0e34872df2972c38b805a9b php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 7e56023c2991831d0f24017fb28b226a10d04bdb php7.4-readline_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 6b07f5158cb482a39bfa0c535c59fb95293dd176 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 3b6af9d30dcab0bc7d5fcd3cf13f9dcbda7bf4ea php7.4-soap_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 8e5538ce6022af02417c204b2a26c460264b6ec3 php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb b5cf2d60a8643486e590bff8f5cbb065fb4cbb3a php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 45f6b4dfa27b3b5f8605b96386bf7549459af2cc php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb f861085570cc1908bfeb00699bca67381ac3381d php7.4-xml_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 1fc958ff7f76a1a37a007d517d58e2c2fef3908f php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb fd290f6758b25ff8f996cc5882b5f0be84da1a07 php7.4-xsl_7.4.33-1+deb11u12+tuxcare.els2_all.deb 7d4b5a4aa47e63d74f6fd36cac48b39f0534ae88 php7.4-zip_7.4.33-1+deb11u12+tuxcare.els2_amd64.deb 4af0a3141bab7e6ebd99561a124090b260c0aa96 libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb a33c282f2fa7f655c3964a4bd2aba21f83fc7d2d libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 56ecf2c5a88ef228ae9610ae1d5ca1400d999a34 php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 984fca81b833ea591986f835e6f6d6effa5c8ef0 php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb e5ef9d0f01a3925a3fe68b009708d46f5dc2cc28 php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb efc4d79763c69a28035b561e0e5b108d1cf3cb7f php7.4-cli_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb ca87459ccb2adb9d1c730ee1b19bfb7fd4d60320 php7.4-common_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 4c9af117d373bb368e8dbf3589c2300cbfb35521 php7.4-curl_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb fb4cb83a5474c4971f00f03d9edecf7b81b4fc4a php7.4-dba_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 258dd7cd789a957e1357f10c68e4008c5504f08f php7.4-dev_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 45db13d98e17bd41e0f47c755f6f77b7bc479f22 php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb db735606f9547fdbd1f2fba51f78ae2f8d995c5a php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb a7807ce95bf9158dbdf4d163861a4b5b292418eb php7.4-gd_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 82ade9edae0ece1e24f1c1485ec17acb2b2ce2d0 php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 9f8982589d7c4493cfa02cd1e7b47f3b242de8a1 php7.4-imap_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 04d1a1248dc03758161a7dfa42c97a9435c30776 php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 4e4b645c32d5f8e497bd0519df13de0f2ccdf08b php7.4-intl_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 38f62d0f66e0c041e9b7c6158989fa0476a9190f php7.4-json_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 110446a07ba515bd53f4b5ef13dbd99bba028caf php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb e8509d556a0c8be9f4ba04a6994912691f136448 php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 6faf735be773786bc77607a70026b04da9a78e4f php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 848c4e516c52ca66b1c9e60b7095ab9ed552a48c php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb ead34a17613fc42e278f86acd2bce6176326ba68 php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb cb7c10326e12896f626924d3fe45084e20a4f699 php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb f82ef298d05c96e1b3d3a2f83404a64361d41db2 php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb af8835a84a0992ef53ac8961eda511d387efe68a php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 7c6d9140f9c086e9ffde06089aa29c98b61fdb6c php7.4-readline_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb df448c0051af0c57c90ffc020b39aac1c2d12563 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 58039854edc72fef55094c628e62e9d8915366e6 php7.4-soap_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb c4b4ccdf5d2f38d1dc8b3e75dcfc722c510ba217 php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb cd5d88f1597f9c3e5998188b187b83c967cac012 php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb c63181311b39943d288ae149ec29aa286620df02 php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 0656a83d998c7605f2d2344c282ace70fd0b61c9 php7.4-xml_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 2238ab3622ee0aaf43f9a3e56013aa516db0e111 php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 3b9dd93289a7cd8aea989acdde761bf10150870c php7.4-zip_7.4.33-1+deb11u12+tuxcare.els2_arm64.deb 3bdfe261c82469debb9b0a132224fcae0fb5ad94 libapache2-mod-php7.4_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 7b44aca9852bc41a4a4411fd00278b784ff5f963 libphp7.4-embed_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 0bbe5e3e5c88c8a8e31716e876eec18c9ea9c3f5 php7.4-bcmath_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 98fad2b0e4b9aa2c3da57e1024a8a887aad3a140 php7.4-bz2_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 41f56d24d53cb619a7ee8cc96807bcb3fc292dc1 php7.4-cgi_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 6c4ea3cb2af8eb0f701f2cb81652db25b64694ab php7.4-cli_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 516cb90d32845d892511d4770249d41033aa808a php7.4-common_7.4.33-1+deb11u12+tuxcare.els2_armel.deb f18fe4466d2443c33b865e48e66e5557cb595819 php7.4-curl_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 545002093e08323c631742cc4951ad7705e8a436 php7.4-dba_7.4.33-1+deb11u12+tuxcare.els2_armel.deb d22fefe69593165b27ef26d4d55776f561573acc php7.4-dev_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 968044493f15e3f8f6aa797784392e84d73b09bb php7.4-enchant_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 622fbc28cf5d8fb0d31bb03e420cc55ff57c0983 php7.4-fpm_7.4.33-1+deb11u12+tuxcare.els2_armel.deb e7630dde615754cd036780537e718c102df2b646 php7.4-gd_7.4.33-1+deb11u12+tuxcare.els2_armel.deb bb30df9438d4cc16aca03b80ce62226e8cffad69 php7.4-gmp_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 06116bb322f10539d729168de35bd7f976af86f6 php7.4-imap_7.4.33-1+deb11u12+tuxcare.els2_armel.deb e96053f456a0a2c37179293f95438ed625e769a2 php7.4-interbase_7.4.33-1+deb11u12+tuxcare.els2_armel.deb e2c46fc31361ab5e12b88f05eb2e536f2613fe9e php7.4-intl_7.4.33-1+deb11u12+tuxcare.els2_armel.deb d8d1b30a0558f80df86be0136fd01c22fea63ddc php7.4-json_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 40581f84b8875176e857d52c881fd51378e35c42 php7.4-ldap_7.4.33-1+deb11u12+tuxcare.els2_armel.deb cc4d1fe46814dd2ccfe3234683b4233e1f478648 php7.4-mbstring_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 7f7ac38818b63fae980faafa249178fc0d9bdaff php7.4-mysql_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 046e776cc4fc30a4a136e746954b09bed6779ce3 php7.4-odbc_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 65ec15977e3f886592341e3ca17bc14d90494d0a php7.4-opcache_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 6bacd1d03f3cf943555d87c9ced358bd0f339c5e php7.4-pgsql_7.4.33-1+deb11u12+tuxcare.els2_armel.deb b4a0a76784d7d3fd2a9d3a266c25fba79eac7400 php7.4-phpdbg_7.4.33-1+deb11u12+tuxcare.els2_armel.deb df68969bb742e02e013529e67e0b900b60d0c485 php7.4-pspell_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 9e55dcebf6521674f4dddf851e8578016119cf10 php7.4-readline_7.4.33-1+deb11u12+tuxcare.els2_armel.deb ef42716ec11977348d7fc4dd6bc24b3bfbc51733 php7.4-snmp_7.4.33-1+deb11u12+tuxcare.els2_armel.deb fec1f48a5d0d3b5f2ad7c3f2f0f60cc00f02f398 php7.4-soap_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 81722252105e6fee91b0cfef1f1baba6ef577c8a php7.4-sqlite3_7.4.33-1+deb11u12+tuxcare.els2_armel.deb c6d4ad0fd433f317c6005f32c7b2f8cfedc225da php7.4-sybase_7.4.33-1+deb11u12+tuxcare.els2_armel.deb d5de0bf57e1afd4af36946cfdf20ec51797fcf58 php7.4-tidy_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 5cc7ecafb11d5190fe296d1de160818f78e75f23 php7.4-xml_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 846abb260cd432a54b6cfbe09b33d23836cbafd3 php7.4-xmlrpc_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 9827a302284c725c24dccd74d252b9a7bedb2148 php7.4-zip_7.4.33-1+deb11u12+tuxcare.els2_armel.deb 49e34e2bfa86c14887eb60938892240a29ff353c CLSA-2026:1792620157 TuxCare License Agreement 0 * SECURITY UPDATE: heap buffer overflow in the read-only dictionary loader via an oversized .rws header size field - debian/patches/CVE-2026-103658.patch: compare the requested size as size_t in String::reserve() in common/string.hpp - CVE-2026-103658 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: heap buffer overflow in the read-only dictionary loader via an oversized .rws header size field - debian/patches/CVE-2026-103658.patch: compare the requested size as size_t in String::reserve() in common/string.hpp - CVE-2026-103658

0 tuxcare-debian11-els aspell_0.60.8-3+tuxcare.els1_amd64.deb 15829ca916206427f5ccf35427f436a69afb17f0 aspell-doc_0.60.8-3+tuxcare.els1_all.deb d9a9f810f710f2689c48f214214b8352a5a73c68 libaspell-dev_0.60.8-3+tuxcare.els1_amd64.deb 5b86ca919cbfd240f3018b33499e06790063f5b1 libaspell15_0.60.8-3+tuxcare.els1_amd64.deb 63b003ecb8deb6465b38399623ee3a8a816f4835 libpspell-dev_0.60.8-3+tuxcare.els1_amd64.deb 0d1be720db6217260e656d93a084d80efed70b71 aspell_0.60.8-3+tuxcare.els1_arm64.deb bfd540c347cf3eb1761c1bd2a93822739fad4636 libaspell-dev_0.60.8-3+tuxcare.els1_arm64.deb 5ec29e1eb2d0e9d3d76db51294c3888bd556275c libaspell15_0.60.8-3+tuxcare.els1_arm64.deb 0bfa264f6489a0bf2de9ab10a8b55ee2154dd2f5 libpspell-dev_0.60.8-3+tuxcare.els1_arm64.deb ff424514a10f7537bae1219c6dd0a401dae8aff0 aspell_0.60.8-3+tuxcare.els1_armel.deb b571bc3fee339803881b01fd85d9656f0e792a66 libaspell-dev_0.60.8-3+tuxcare.els1_armel.deb 60d3aeabd2eebf222d799a7ce0578b0276f20588 libaspell15_0.60.8-3+tuxcare.els1_armel.deb f6744d6bc50ff2f648f0a1a4e4f8d775d9023194 libpspell-dev_0.60.8-3+tuxcare.els1_armel.deb 6c9e1d2b81dd4a4c47273ea5859d451e6a2416cd CLSA-2026:1789730024 TuxCare License Agreement 0 * Drop the (<< 1:6.0) version constraint on the libdb-dev build dependency in debian/control.in and debian/control, matching debian10els. Bullseye ships only libdb-dev 5.3.1+nmu1, so the constraint excludes nothing, and the builder's pbuilder-satisfydepends misreads the '<<' relation as a build-profile restriction and skips installing the package entirely. * SECURITY UPDATE: directory traversal when extracting tar archives - debian/patches/CVE-2007-4559.patch: add the PEP 706 extraction filter API to Lib/tarfile.py, providing the fully_trusted, tar and data filters, the FilterError exception hierarchy, the TarFile. extraction_filter attribute and the filter= argument to extract() and extractall(), so that callers can reject members that would escape the destination directory. Includes the upstream follow-ups gh-149486 and gh-155999, which validate the written link target and normalise a member name that leaves the destination and comes back. The filters remain opt-in and do not contain a member extracted at errorlevel=0 or through makelink()'s hardlink fallback; see the patch header - CVE-2007-4559 * SECURITY UPDATE: quadratic complexity in IDNA decoding - debian/patches/CVE-2022-45061.patch: replace the per-character 'for c in RandAL: if c:' BIDI loop in nameprep() with a single 'if any(RandAL):' test in Lib/encodings/idna.py, so the RandALCat checks run once instead of once per character, restoring linear behaviour - CVE-2022-45061 * SECURITY UPDATE: control character injection via http cookies - debian/patches/CVE-2026-0672.patch: reject control characters in Morsel keys, values, coded values and reserved attributes in Lib/Cookie.py - CVE-2026-0672 * SECURITY UPDATE: incomplete fix for the http cookie control character injection - debian/patches/CVE-2026-3644.patch: apply the same control character rejection to Morsel.update() and js_output() in Lib/Cookie.py, which the previous fix left unguarded - CVE-2026-3644 * SECURITY UPDATE: configuration file injection via carriage returns in written option values - debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file - CVE-2026-0864 * SECURITY UPDATE: C stack overflow parsing deeply nested content models - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall(), so that a deeply nested element declaration raises RuntimeError instead of crashing the interpreter - CVE-2026-4224 * SECURITY UPDATE: argument injection via leading dashes in browser URLs - debian/patches/CVE-2026-4519.patch: reject URLs beginning with a dash in BaseBrowser._check_url() in Lib/webbrowser.py, so that a URL can no longer be passed to the browser process as an option - CVE-2026-4519 * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations in incremental parsing - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and parse it once enough has piled up, in Lib/HTMLParser.py - CVE-2026-15308 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Drop the (<< 1:6.0) version constraint on the libdb-dev build dependency in debian/control.in and debian/control, matching debian10els. Bullseye ships only libdb-dev 5.3.1+nmu1, so the constraint excludes nothing, and the builder's pbuilder-satisfydepends misreads the '<<' relation as a build-profile restriction and skips installing the package entirely. * SECURITY UPDATE: directory traversal when extracting tar archives - debian/patches/CVE-2007-4559.patch: add the PEP 706 extraction filter API to Lib/tarfile.py, providing the fully_trusted, tar and data filters, the FilterError exception hierarchy, the TarFile. extraction_filter attribute and the filter= argument to extract() and extractall(), so that callers can reject members that would escape the destination directory. Includes the upstream follow-ups gh-149486 and gh-155999, which validate the written link target and normalise a member name that leaves the destination and comes back. The filters remain opt-in and do not contain a member extracted at errorlevel=0 or through makelink()'s hardlink fallback; see the patch header - CVE-2007-4559 * SECURITY UPDATE: quadratic complexity in IDNA decoding - debian/patches/CVE-2022-45061.patch: replace the per-character 'for c in RandAL: if c:' BIDI loop in nameprep() with a single 'if any(RandAL):' test in Lib/encodings/idna.py, so the RandALCat checks run once instead of once per character, restoring linear behaviour - CVE-2022-45061 * SECURITY UPDATE: control character injection via http cookies - debian/patches/CVE-2026-0672.patch: reject control characters in Morsel keys, values, coded values and reserved attributes in Lib/Cookie.py - CVE-2026-0672 * SECURITY UPDATE: incomplete fix for the http cookie control character injection - debian/patches/CVE-2026-3644.patch: apply the same control character rejection to Morsel.update() and js_output() in Lib/Cookie.py, which the previous fix left unguarded - CVE-2026-3644 * SECURITY UPDATE: configuration file injection via carriage returns in written option values - debian/patches/CVE-2026-0864.patch: normalise CR and CRLF, and not only LF, into '\n\t' continuation lines when writing option values in RawConfigParser.write() in Lib/ConfigParser.py, so that an attacker-controlled value can no longer inject additional sections, keys and values into the written file - CVE-2026-0864 * SECURITY UPDATE: C stack overflow parsing deeply nested content models - debian/patches/CVE-2026-4224.patch: guard conv_content_model() in Modules/pyexpat.c with Py_EnterRecursiveCall(), so that a deeply nested element declaration raises RuntimeError instead of crashing the interpreter - CVE-2026-4224 * SECURITY UPDATE: argument injection via leading dashes in browser URLs - debian/patches/CVE-2026-4519.patch: reject URLs beginning with a dash in BaseBrowser._check_url() in Lib/webbrowser.py, so that a URL can no longer be passed to the browser process as an option - CVE-2026-4519 * SECURITY UPDATE: CPU denial-of-service in html.parser.HTMLParser via repeated unterminated markup declarations in incremental parsing - debian/patches/CVE-2026-15308.patch: accumulate incrementally fed data in a list and only join and parse it once enough has piled up, in Lib/HTMLParser.py - CVE-2026-15308

0 tuxcare-debian11-els idle-python2.7_2.7.18-8+deb11u1+tuxcare.els1_all.deb d9f0feb28c034b95a3f0bbd4b781c01dd77faa1c libpython2.7_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb c0e1fffbf91a217bde06d8b6c67e6a57f9c5b280 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb b1e73b0082e915e4de076970a9b4426eff1505fb libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb c298cfe5a4c0a69c5b32e563f640b69031020b6c libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb 2af0eb4b44e9bba0df2f11ac58f39e378cd32f74 libpython2.7-testsuite_2.7.18-8+deb11u1+tuxcare.els1_all.deb ee49844de4446cbb62c28bd140be4ccdd0f215f1 python2.7_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb 8032ad197111c6343cc003491f65fa0b2e9b77c2 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb d8a6dc34211c38f73af4fb945d4442170fbc4810 python2.7-doc_2.7.18-8+deb11u1+tuxcare.els1_all.deb eaca0a476da2367f9fcb5e979dc6123fd1c3caec python2.7-examples_2.7.18-8+deb11u1+tuxcare.els1_all.deb 28cd1044d32d33dcbcca7cfbc74b55b60cade5ea python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_amd64.deb 5730a0a8aedd7be60f4437702e0ac2e12b77fd52 libpython2.7_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb a5b8027646ba979e57b3500410c6fde936a7d7b0 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb 09eccc6d335ae4e2b2b98fcc40ad195daa335b49 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb 46d333a9d6aa1faaf74619bf429c2c343869f3bd libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb ecdeb0467213174664d2f7338cdd90a172259792 python2.7_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb 7d801af6e6cc7b00e56bef2caecea64792c809db python2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb 5bb115f155dd6bc73349e671af4078d982aa2dfc python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_arm64.deb c1f89a71933302cc1f87b008054a48d498ec2586 libpython2.7_2.7.18-8+deb11u1+tuxcare.els1_armel.deb d2d3e7635e1c04bb54fec903f1ffbc9823f8aaa3 libpython2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_armel.deb da8ebf6e78b84396dea3b3a7318657854cf18ca7 libpython2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_armel.deb 865ee79411d17ee860b7e6a374f8c5a8ca3a309a libpython2.7-stdlib_2.7.18-8+deb11u1+tuxcare.els1_armel.deb 02b6fa75ddc12631b3831688ca29feb010dfa2c3 python2.7_2.7.18-8+deb11u1+tuxcare.els1_armel.deb 777eedf92f1df1f9222480990bb246b410eca1b8 python2.7-dev_2.7.18-8+deb11u1+tuxcare.els1_armel.deb 8b092372657ea7d1d98359edf47695fa28473cd1 python2.7-minimal_2.7.18-8+deb11u1+tuxcare.els1_armel.deb 135a1e52a068a520d83cb27466139d291a79ba54 CLSA-2026:1792768301 TuxCare License Agreement 0 * SECURITY UPDATE: buffer overflow in URI to path mapping with alias after a rewrite - debian/patches/CVE-2026-15176.patch: also reject URI to path mapping in ngx_http_map_uri_to_path() when r->uri_changed is set, so a URI rewritten inside an "alias" location can no longer be mapped while it is shorter than the location prefix and underflow the computed path length - CVE-2026-15176 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: buffer overflow in URI to path mapping with alias after a rewrite - debian/patches/CVE-2026-15176.patch: also reject URI to path mapping in ngx_http_map_uri_to_path() when r->uri_changed is set, so a URI rewritten inside an "alias" location can no longer be mapped while it is shorter than the location prefix and underflow the computed path length - CVE-2026-15176

0 tuxcare-debian11-els libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb f950f3f77bd172435aa019e5730849bda499674c libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 83502d7bd0bf3f5c1659a01c2e14786bc02bf5e6 libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 4a8c2be2e8cf9addc22840b0577af8c3ff6dca61 libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 10f71b523bd88d53a78241393d5ab795aab07b24 libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 8717eb74f364fa848995e3ef574ec7617d991e8d libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 49345d9b74d63c37baf3e3545aac7f90df99c53f libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 80c9aeb81631f228274ae835f97592868afdfd96 libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb aa963982b0b903cfcacf02ddd68f0f536ec4ecc1 libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 8c6bd9e3849109b966c9ca9a5478b54477b37b30 libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 079dfa28f3f226860c49a2edf6efafab3d0536a0 libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 0beb84504cbf9e90d498bed1ae895fcca22fc917 libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 02b5c0b4d76f35d5363bcc54225b9033004e8e49 libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 80e4265c2d649219f0a5f8e97b51b41b2e83b38d libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb e920410e6ab5871a41e09323de5db5d54e6810cf libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 67edd389cc0f7536e8d814fd9d2af45b6b11abe0 libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb d15babc48000d3bac641cfa86081b70088c2b724 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb b4b561e0c0d77304bd3ca7fb0d3144ab05ad6b68 libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb b098992361cff116b9ae7a806260a95a0db2c1bb libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 3b78a765a6a878f2ee3524bd891d4988a43ec985 libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 1e3e853eab25608d291a4075e3f9fc8d72027447 libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb f0d5ced1c4038f9ba2117f6461cbd37c9156ae53 libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb 03fc4c3843f9b796013d16736b1fa496403ad108 nginx_1.18.0-6.1+deb11u8+tuxcare.els2_all.deb 020b215672b4fa461ea66d4dff4be5ed2e2986d9 nginx-common_1.18.0-6.1+deb11u8+tuxcare.els2_all.deb c00f97bc199c0d2b450ae842341c072a4c8ca295 nginx-core_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb f42ebaa77390757d77b474a83dc5025761a5f2c4 nginx-doc_1.18.0-6.1+deb11u8+tuxcare.els2_all.deb a0a4febeaf96ed314584b22b64630faf29923194 nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb b2cc1126cd9f9cb8f4b0c85b3fd8676711aff408 nginx-full_1.18.0-6.1+deb11u8+tuxcare.els2_all.deb c8c24af4acc0f323227860b3b472098fed110f84 nginx-light_1.18.0-6.1+deb11u8+tuxcare.els2_amd64.deb f13b9a4ea31574e2b5dfabb24e84611ec369ae0c libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 6015ebb69cc2455251042dfbd4e6a91255d0fe11 libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 1ddb25a45faa5e9378eb2e1546237b5b23937a67 libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb b01e154f707a288c42436a8976ad2554dfd4b142 libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 72341422180444de6cc4f0e368239652f3e69ee0 libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 4465ce00c4e51d0a3c8be50fbd5b156711c5be56 libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 5f71ee8528780a6453f580f2945fce2509b0d5aa libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 3e22690254b96785e25831bc5eb7909d4927e989 libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 3c7b9394ed2d8f7e57d91ee6379e0335314eef5b libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 9ce4e19aa7bca6607e2c7eb69592d8bedd126b2f libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb d27ff0ed5e06a349266d310fbb6b8b78a9d00192 libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 96932fcf2515619ce5829510b75fe112d2c02d70 libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 9c3225612a6a3c6b0997b56c3f681f549fda279e libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 5e3c21758a3280ee9f9e734cfdddc6e768eda8d0 libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 606f35340698bd0d336859c5ff8250cef8508b52 libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb b74bb02582477301cf642095c14bdbed1292c5fc libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 09eeddabdabb67dc357e551fa5f1ef1e510ca3a7 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 8391246a5627553f5d79111be48aa4072da50e02 libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb b0b88acee98a8cc981dc7e320cf0622278dac7d7 libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb dcb054c1c2c446b4b8085cc5d36158ee4c7d2066 libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 9b17316da6026d23b828c5d5c7b101bc8bfc749a libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 0075b4ebae7ce0a72d210df72cb7336a0747e053 libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb f4886bf2acf23ca69f02f2ea1a37fff1457bce6f nginx-core_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb 1261435195d62f07f8701826b1c9aa3d78997583 nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb bc3e830dcf61a379b38d53ef0f97f81a0c23e035 nginx-light_1.18.0-6.1+deb11u8+tuxcare.els2_arm64.deb be2852c9beeb0b908e94e5cb1943360d20835cea libnginx-mod-http-auth-pam_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 785e766f1a7843c07040a241d89c7b709f8e23df libnginx-mod-http-cache-purge_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb d32299d7abefe34d7a2be0109528a33821d55361 libnginx-mod-http-dav-ext_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 5341645742fe03e8fe0ea3d0a8dbd5a41067b07b libnginx-mod-http-echo_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 68f239db0b5dec0e0e7327abf1500f281f8ddbbe libnginx-mod-http-fancyindex_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb b73d0be138d2b2f104da49863e7e082aee707888 libnginx-mod-http-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 107097f332b8d02721ca7b59afc87c9a4cc557aa libnginx-mod-http-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 86c066c46409bacb98faa94da8c0c7ea72421b25 libnginx-mod-http-headers-more-filter_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 1a0ec995e5b121885317c72f2538e5c830a895fb libnginx-mod-http-image-filter_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 2ad88e5ce8d24ceae294b9a05135df1d8f374fea libnginx-mod-http-lua_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 6db795bfc0a97cfeb7327f5c7ae0bf7e9ff943ad libnginx-mod-http-ndk_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 1d62171508a6615242e77ea1912e93b800bf67fe libnginx-mod-http-perl_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb edcd3a5373d51009ff93628f5f2208c614a5a752 libnginx-mod-http-subs-filter_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb bbc28c4c1f3c00f4026be20745f805a692023475 libnginx-mod-http-uploadprogress_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 327814cc310293dc780779422f7f9cd856870c3b libnginx-mod-http-upstream-fair_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb c337f0bd0081334bfe82ca0d2d488bb7e88d96dc libnginx-mod-http-xslt-filter_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb db5f36168a9b5d4de913ac0437d89fbf44197b70 libnginx-mod-mail_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 149591c86e1a986ac99c157be190fc759a130b54 libnginx-mod-nchan_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 1e892d0dd5211fe88eabbd5e47a0de2b20bdb243 libnginx-mod-rtmp_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 8501122c40843756096c74a2a789847a85b86888 libnginx-mod-stream_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 62fd9f20908d1523715975ed1f590091a550f4f5 libnginx-mod-stream-geoip_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb d22a5a9b3d6f34cc7a82de3ea7434e9c03366df9 libnginx-mod-stream-geoip2_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 555aa408123b3800de5927a831b0762ddc6e361d nginx-core_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 589da35b976cc9815c5543a5b852460760c27bc1 nginx-extras_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 26b81f5301005ab2b79643440b7b401bfffa372c nginx-light_1.18.0-6.1+deb11u8+tuxcare.els2_armel.deb 00f4f0155c786f20224d9cd423f13939308e0ffd CLSA-2026:1792769384 TuxCare License Agreement 0 * Bump kernel ABI to 52: ship the ELS kernel as 5.10.0-52-*, distinct from the prior 5.10.0-51. * Miscellaneous upstream changes - net: skbuff: propagate shared-frag marker in skb_zerocopy() None Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* Bump kernel ABI to 52: ship the ELS kernel as 5.10.0-52-*, distinct from the prior 5.10.0-51. * Miscellaneous upstream changes - net: skbuff: propagate shared-frag marker in skb_zerocopy()

0 tuxcare-debian11-els bpftool_5.10.272-2+tuxcare.els1_amd64.deb 3919739ca0572208dafc1effc90afebb61f22fd4 hyperv-daemons_5.10.272-2+tuxcare.els1_amd64.deb ab82d563247e12002a5798f547b3fa11b333088c libcpupower-dev_5.10.272-2+tuxcare.els1_amd64.deb 9977f22fd51eae409ccd49b76d11ab62c4a5032a libcpupower1_5.10.272-2+tuxcare.els1_amd64.deb d64f9d1b47f7f3017f8340282435716411966c0e linux-compiler-gcc-10-x86_5.10.272-2+tuxcare.els1_amd64.deb dcd14d033f56d8a68c2cf3f3b227b63447315d84 linux-config-5.10_5.10.272-2+tuxcare.els1_amd64.deb ee69046fecf5eff3545dc3623870076e801fafe4 linux-cpupower_5.10.272-2+tuxcare.els1_amd64.deb 589b16009fab93bb25e5cd666736f782344d5a0f linux-doc_5.10.272-2+tuxcare.els1_all.deb bd99f5fc4b4b15ced04a8c8c17b4ee874e015623 linux-doc-5.10_5.10.272-2+tuxcare.els1_all.deb 06001f94d1d8edd2f8d6168fc858caf476a9c07a linux-headers-5.10.0-52-amd64_5.10.272-2+tuxcare.els1_amd64.deb e44f2d8ff220c9a9a1239417498a0ae951e4dc4f linux-headers-5.10.0-52-common_5.10.272-2+tuxcare.els1_all.deb 904849c1b6e85284efeea43d9e5c4a4ae343a0f6 linux-headers-amd64_5.10.272-2+tuxcare.els1_amd64.deb bd85eb5e87229b1550688a3a929d55d97f35bc49 linux-image-5.10.0-52-amd64-unsigned_5.10.272-2+tuxcare.els1_amd64.deb 560530df17538b96eb268c5c3b19d69dd669c269 linux-image-amd64_5.10.272-2+tuxcare.els1_amd64.deb 98b95fa93bd4a6accbd6003fae22b29f928aff03 linux-image-amd64-signed-template_5.10.272-2+tuxcare.els1_amd64.deb 08a73072087cc86ae883ce203434afd0667baa2a linux-kbuild-5.10_5.10.272-2+tuxcare.els1_amd64.deb 5911195b1b540945d1335aa8730cfc1e2eaa92fd linux-libc-dev_5.10.272-2+tuxcare.els1_amd64.deb 42dc55b6bca891f36909408c4ea60fe515d921fa linux-perf_5.10.272-2+tuxcare.els1_amd64.deb b2e9d91e30996c79414f25dd5ab29628341d977e linux-perf-5.10_5.10.272-2+tuxcare.els1_amd64.deb a3029988fbe3c3fa3730458d7aefd493021a437b linux-source_5.10.272-2+tuxcare.els1_all.deb bcddc45c6cfdf338e92cf67250e51b99e9c951b1 linux-source-5.10_5.10.272-2+tuxcare.els1_all.deb 1ae02db807eb7f261bf82a7a0565e4f9fcfc10a6 linux-support-5.10.0-52_5.10.272-2+tuxcare.els1_all.deb 363aad3b72394ea53ea8e8fd60cc64b7c6ed7093 bpftool_5.10.272-2+tuxcare.els1_arm64.deb dcda043b942524850e9594ff621e107121d05499 hyperv-daemons_5.10.272-2+tuxcare.els1_arm64.deb d45f254c699052997b15c5f28b37a055ea50396f libcpupower-dev_5.10.272-2+tuxcare.els1_arm64.deb f35d862c857b24ea67c6ed7878b7ef0181de72bc libcpupower1_5.10.272-2+tuxcare.els1_arm64.deb 99efc120c45ac57baa29dd9f813d6eeb7ecd55f2 linux-config-5.10_5.10.272-2+tuxcare.els1_arm64.deb 92866c1c564e7370a2c051f332b390ae8d32f9d0 linux-cpupower_5.10.272-2+tuxcare.els1_arm64.deb 4d7deb34882b6f73768e2cb85afc47c404a1f816 linux-headers-5.10.0-52-arm64_5.10.272-2+tuxcare.els1_arm64.deb 2061aa780545f1d93d2174085cb545bc42f5158a linux-headers-arm64_5.10.272-2+tuxcare.els1_arm64.deb 8197f49d8b8bba2513a0f1663658f822a1ce143f linux-image-5.10.0-52-arm64-unsigned_5.10.272-2+tuxcare.els1_arm64.deb 75c0d3c2e2ab0cfc6100bfe5f59d3df46b703fac linux-image-arm64_5.10.272-2+tuxcare.els1_arm64.deb 0635885ee3a84fa30cea4e1614f8a1415f04d9dc linux-image-arm64-signed-template_5.10.272-2+tuxcare.els1_arm64.deb 3b24ec1be3aaed7cbde252145b42d47e770d7027 linux-kbuild-5.10_5.10.272-2+tuxcare.els1_arm64.deb d484a52841ced834b8a033e150d6a24133384585 linux-libc-dev_5.10.272-2+tuxcare.els1_arm64.deb ce71461a1446dd2fc18a44a011819c90b302964d linux-perf_5.10.272-2+tuxcare.els1_arm64.deb 9b93ab746eb3582b5d12a5eb5bc81d357c44755e linux-perf-5.10_5.10.272-2+tuxcare.els1_arm64.deb e2391db246a84b30caceeae2e355b859acbe4342 bpftool_5.10.272-2+tuxcare.els1_armel.deb 09fc1836f61f322239869b7209049d4875e88803 libcpupower-dev_5.10.272-2+tuxcare.els1_armel.deb 849c43d6756007fbec13e04e1990060c682e24e7 libcpupower1_5.10.272-2+tuxcare.els1_armel.deb e10106263033b5c43e97ee45c5f1a828fbd052c0 linux-compiler-gcc-10-arm_5.10.272-2+tuxcare.els1_armel.deb 2acc96f66e2ed483dc02e5063fca1c6da209953d linux-config-5.10_5.10.272-2+tuxcare.els1_armel.deb 37fe275a7f8b3162ec56c0bdc92f157f8417c31c linux-cpupower_5.10.272-2+tuxcare.els1_armel.deb 3f08d444b2ea3977a1a822e3c1a308db7bfc8f98 linux-headers-5.10.0-52-marvell_5.10.272-2+tuxcare.els1_armel.deb fc26955536943045be7b941e1bcac24d2eea7d5b linux-headers-5.10.0-52-rpi_5.10.272-2+tuxcare.els1_armel.deb 4d84104fabc2f209ef03b2943fbe71b47d71e2c5 linux-headers-marvell_5.10.272-2+tuxcare.els1_armel.deb 328f6f05881b1acb08766ebae972d5a41525c497 linux-headers-rpi_5.10.272-2+tuxcare.els1_armel.deb 65b5e73f71399529290019cd8320b833c8a745e6 linux-image-5.10.0-52-marvell_5.10.272-2+tuxcare.els1_armel.deb dbd7dc6b8558b836b79aeb8a202e6e4d1a8d1771 linux-image-5.10.0-52-rpi_5.10.272-2+tuxcare.els1_armel.deb efcf7a590a19900ca23c167fbfbb34321a715040 linux-image-marvell_5.10.272-2+tuxcare.els1_armel.deb 7d99dedd14772c6b57d6e9d168a536c06cc11392 linux-image-rpi_5.10.272-2+tuxcare.els1_armel.deb 74873f6d043c6c337932e78b1d1d457749e43326 linux-kbuild-5.10_5.10.272-2+tuxcare.els1_armel.deb 3d081164dccc96e9546adcf7e092c0a55303f077 linux-libc-dev_5.10.272-2+tuxcare.els1_armel.deb 6b7aac584600e2badf5e2e38c10f2e67a5615866 linux-perf_5.10.272-2+tuxcare.els1_armel.deb cda8610ba40dd3020293d07dcc0cead0aedbbf86 linux-perf-5.10_5.10.272-2+tuxcare.els1_armel.deb 41afaa2dc3024688b95083123ec309cbbba925d1 CLSA-2026:1792797810 TuxCare License Agreement 0 * SECURITY UPDATE: regexp: out-of-bounds repeat stack access in Onigmo when the range-repeat or null-check ID overflows its internal type - debian/patches/CVE-2026-110264.patch: reject overflowed IDs - CVE-2026-110264 * SECURITY UPDATE: regexp: wrapped jump offsets in Onigmo from an integer overflow in the quantifier expansion size check and from compiled programs too big for their offset type - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the expansion size by division and cap the compiled program size - CVE-2026-93577 - CVE-2026-97229 * debian/rules: run test-all for test/ruby/test_regexp.rb only; the full suite aborts with a core dump after the last test on the build system Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: regexp: out-of-bounds repeat stack access in Onigmo when the range-repeat or null-check ID overflows its internal type - debian/patches/CVE-2026-110264.patch: reject overflowed IDs - CVE-2026-110264 * SECURITY UPDATE: regexp: wrapped jump offsets in Onigmo from an integer overflow in the quantifier expansion size check and from compiled programs too big for their offset type - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the expansion size by division and cap the compiled program size - CVE-2026-93577 - CVE-2026-97229 * debian/rules: run test-all for test/ruby/test_regexp.rb only; the full suite aborts with a core dump after the last test on the build system

0 tuxcare-debian11-els libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb 125a84911ea5cffc584af76b9f22596d91dc93d6 ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb aad00b82ebf80d79c259174ad343403b6353aa99 ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb d5be023a9b4b74a4cf5311d02d9938bf506a07e1 ruby2.7-doc_2.7.4-1+deb11u6+tuxcare.els1_all.deb ccf3861627b6ab2bad5a4982187802518cdb547d libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb 0322a36b29986fe1ad351af0e2cc3b9f100c4848 ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb 13c3669d3f51cefa1405abdd46fab8a69b8d3867 ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb 527b9de97733725b08780967b01103bdfe7034f2 libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_armel.deb 8fc7cb48c3244a57345dc78a82f4c8f796b14d25 ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_armel.deb 3071c73ab7b093088c187b85ca2516ab2ca05fa4 ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_armel.deb 2bdd586da7d2e39ef11ca71f57c12e083cde7983 CLSA-2026:1792806098 TuxCare License Agreement 0 * SECURITY UPDATE: request smuggling via Transfer-Encoding: identity - debian/patches/CVE-2026-61642.patch: reject Transfer-Encoding: identity - CVE-2026-61642 Important Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: request smuggling via Transfer-Encoding: identity - debian/patches/CVE-2026-61642.patch: reject Transfer-Encoding: identity - CVE-2026-61642

0 tuxcare-debian11-els squid_4.13-10+deb11u7+tuxcare.els3_amd64.deb 6fd66c0acad24dd70e145bf3f439c826b7f7ea32 squid-cgi_4.13-10+deb11u7+tuxcare.els3_amd64.deb 35d911dc08d1948ee7d58871f90c4152361617d8 squid-common_4.13-10+deb11u7+tuxcare.els3_all.deb 253c3d82ce9a6a86491cf33fed828e5ae0d3f8e0 squid-openssl_4.13-10+deb11u7+tuxcare.els3_amd64.deb 422ef470bc6b349cc47bbb8e4ec9ffa82a608d85 squid-purge_4.13-10+deb11u7+tuxcare.els3_amd64.deb 7b5329e1a82d8bf106496c0cfe0bf60589a9ef6a squidclient_4.13-10+deb11u7+tuxcare.els3_amd64.deb 8633a000172660c748ac815ab197a1ceef7f0213 squid_4.13-10+deb11u7+tuxcare.els3_arm64.deb c137effa470442adfb0be0be01583f5e00f08c93 squid-cgi_4.13-10+deb11u7+tuxcare.els3_arm64.deb a0543f2b637a70fc44fa6f6916e3cd7269180624 squid-openssl_4.13-10+deb11u7+tuxcare.els3_arm64.deb c8229eb5b92be821baa0789c4113dcaad3267f2a squid-purge_4.13-10+deb11u7+tuxcare.els3_arm64.deb 23a442349a2bf0e30148fed772293d474f9eb9e0 squidclient_4.13-10+deb11u7+tuxcare.els3_arm64.deb c20d2114e1edb1644fbfa3eeac3233a944747b73 squid_4.13-10+deb11u7+tuxcare.els3_armel.deb 2bde40609a87c2faa423b9080f01dd7124dc76d4 squid-cgi_4.13-10+deb11u7+tuxcare.els3_armel.deb fba35027a4b634363fac6b9b39805a692109b092 squid-openssl_4.13-10+deb11u7+tuxcare.els3_armel.deb 809dabde81445499b79ecb337bf05a0a0585d477 squid-purge_4.13-10+deb11u7+tuxcare.els3_armel.deb cd774d26fe6b4df1a4fc6bceab34ac935cb310d4 squidclient_4.13-10+deb11u7+tuxcare.els3_armel.deb 042120ac4c0f2620a2d08bca77271ce7735f1b91 CLSA-2026:1792824375 TuxCare License Agreement 0 * SECURITY UPDATE: Out-of-bounds write via invalid block switch in the decoder - debian/patches/CVE-2026-111497.patch: return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH from DecodeBlockTypeAndLength and propagate it through the literal, command and distance block-switch wrappers in c/dec/decode.c, so a crafted stream aborts decoding instead of continuing with inconsistent block state - CVE-2026-111497 Critical Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the CLN.

* SECURITY UPDATE: Out-of-bounds write via invalid block switch in the decoder - debian/patches/CVE-2026-111497.patch: return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH from DecodeBlockTypeAndLength and propagate it through the literal, command and distance block-switch wrappers in c/dec/decode.c, so a crafted stream aborts decoding instead of continuing with inconsistent block state - CVE-2026-111497

0 tuxcare-debian11-els brotli_1.0.9-2+tuxcare.els1_amd64.deb d6151553c7c6008ef26537e4d955cdf5aebe1504 libbrotli-dev_1.0.9-2+tuxcare.els1_amd64.deb ae7b1f25c8c73e6d5f0beba80b45f2065461f029 libbrotli1_1.0.9-2+tuxcare.els1_amd64.deb 807acf6ab46209859d6a6fe19c079fbbfa0fbdac python3-brotli_1.0.9-2+tuxcare.els1_amd64.deb cc33405d25c44a09089695ef9a2c8ed4221e7215 brotli_1.0.9-2+tuxcare.els1_arm64.deb 30f47aca9e79799de6583b021821e543e5306e2a libbrotli-dev_1.0.9-2+tuxcare.els1_arm64.deb 70955cbd7681e6da9fbc1585e79111f35ec9041c libbrotli1_1.0.9-2+tuxcare.els1_arm64.deb a9f6997d7668e0396a20891bb9ee0e3a641fcdbb python3-brotli_1.0.9-2+tuxcare.els1_arm64.deb fd95c4975ff2ec758b3df547b0763d3aee04ab3a brotli_1.0.9-2+tuxcare.els1_armel.deb f6207c6b0aa329783ad290feac14b6f7818b8c62 libbrotli-dev_1.0.9-2+tuxcare.els1_armel.deb 66221d5dccd70393e766e6d252edd60bc6926e18 libbrotli1_1.0.9-2+tuxcare.els1_armel.deb fce3fef02e77bb6d4f56e6eecc3498f2cbd739b6 python3-brotli_1.0.9-2+tuxcare.els1_armel.deb d37e68fcce3e49f3f18b880658d6e6d50073c63e