AZL-97793 CVE-2026-80526 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

AZL-97811 CVE-2026-80529 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

CVE-2026-80526

In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2562: Validate values for volume writes tas2562volumecontrolput does not do any validation of the control value written by userspace, it uses it to look up a value in a fixed size array which can easily be overflowed and...

CVE-2026-80523

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will...

AZL-97814 CVE-2026-80521 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

CVE-2026-80520

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

CVE-2026-80521

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80525

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...

CVE-2026-80564

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 551.943697 BUG: kernel NULL...

CVE-2026-80532

In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrepiunlinkresolvebucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move ...

CVE-2026-80567

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmif54bufferqueue waited for the worker thread to finish but ignored whether it succeeded. If the worker failed e.g., due to a timeout or register read...

CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

CVE-2026-80545

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80554

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary but not architectural limit to the number of CCWs that c...

CVE-2026-80588

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...

CVE-2026-80553

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...