AZL-109167 CVE-2026-98550 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98551

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

CVE-2026-98553

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98554

In the Linux kernel, the following vulnerability has been resolved: vlan: ensure sufficient headroom in vlandevhardheader Callers that only reserve ETHHLEN or less such as llcallocframe, or skbs allocated before dynamic device/headroom changes e.g. toggling VLANFLAGREORDERHDR or bonding/team...

CVE-2026-98550

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98556

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

CVE-2026-98555

In the Linux kernel, the following vulnerability has been resolved: llc: fix skb UAF and leaks on llcmachdrinit failure In llcconnacresendixxxxset0orsendrr, if llcmachdrinit fails, kfreeskbskb is called instead of kfreeskbnskb. This leaks the newly allocated nskb, reads from the freed skb via...

CVE-2026-98558

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

CVE-2026-98557

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

AZL-108945 CVE-2026-98544 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

AZL-109181 CVE-2026-98549 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

AZL-108659 CVE-2026-98547 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

AZL-108680 CVE-2026-98548 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

AZL-108849 CVE-2026-98545 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98548

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98547

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...