UBUNTU-CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

AZL-97791 CVE-2026-74754 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once again before scsiautopmputhost. That is racy when a PM-triggered err...

AZL-97761 CVE-2026-74752 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74750

In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: cryptofreeaead...

CVE-2026-74751

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REGL t1, SZREGt0 // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74753

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

AZL-97778 CVE-2026-74753 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

AZL-97782 CVE-2026-74743 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

AZL-97799 CVE-2026-74744 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74743

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit neededheadroom and neededtailroom from lowerdev macvlan devices inherit hardheaderlen from lowerdev during macvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying lowerdev requires...

CVE-2026-74744

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit neededheadroom and neededtailroom from phydev ipvlan devices inherit hardheaderlen from phydev during ipvlaninit, but leave neededheadroom and neededtailroom set to 0. When the underlying phydev or stacked lower...

CVE-2026-74745

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...

CVE-2026-74747

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...

AZL-97733 CVE-2026-74748 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

AZL-97821 CVE-2026-74746 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

CVE-2026-74746

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

CVE-2026-74748

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

AZL-97830 CVE-2026-74747 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...

AZL-97743 CVE-2026-74735 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session refcount leak on seqfile release In pppol2tpprocopen and l2tpdfsseqopen, iteration state pd-tunnel and pd-session is kept in seqfile private data to allow iteration across multiple read system calls...