CVE-2026-80721

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

CVE-2026-80720

In the Linux kernel, the following vulnerability has been resolved: iomap: add a separate bioset for iomapsplitioend iomapsplitioend can split bios that already come from iomapioendbioset and thus deadlock when the bioset is exhausted. Add a separate bioset to avoid this deadlock. Christian Braun...

AZL-98105 CVE-2026-80714 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest copies connection flags from the destination into cp-flag...

AZL-98112 CVE-2026-80715 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

AZL-98142 CVE-2026-80721 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: ensure no dangling hcon references in isoconn After isoconndel, ISO sockets should not dereference the hcon any more. Currently, clearing isoconn::hcon relies on isoconndel releasing the last reference to the...

CVE-2026-80715

In the Linux kernel, the following vulnerability has been resolved: igc: remove napisynchronize in igcdown When an AFXDP zero-copy application is killed abruptly, the XSK pool is torn down but NAPI keeps polling. igccleanrxirqzc then returns the full budget on every poll, so napicompletedone neve...

CVE-2026-80716

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: wake linked drain waiters on unlink sndpcmdrain on a linked stream parks an on-stack wait entry on the drained peer's runtime-sleep, and after scheduletimeout removes it only if that peer is still found in the caller's...

AZL-98120 CVE-2026-80709 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

AZL-98060 CVE-2026-80708 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...

AZL-98099 CVE-2026-80706 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: can: softing: fwparse: validate firmware record spans fwparse reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make...

CVE-2026-80706

In the Linux kernel, the following vulnerability has been resolved: can: softing: fwparse: validate firmware record spans fwparse reads a fixed record header, a firmware-provided payload, and a trailing checksum without knowing the end of the firmware blob. A truncated record can therefore make...

CVE-2026-80713

In the Linux kernel, the following vulnerability has been resolved: iouring: preserve task restrictions across exec Per-task restrictions apply to all rings created by a task. Once installed, they should not be dropped across exec. For a task that has used iouring, the exec cancellation path call...

CVE-2026-80712

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...

AZL-98108 CVE-2026-80707 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Zero the allocated buffer in j1939sessionfreshnew to ensure it contains no residual data. While there is a potential performance impact if users allocate...

AZL-98193 CVE-2026-80710 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80705

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check if dml21addphantomplane is successful Verify that the phantom plane was allocated to avoid a later segfault. cherry picked from commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f...

CVE-2026-80708

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could lead ...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

CVE-2026-80710

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix undersized format-check buffer fmtbuffersize in dasdeckdcheckdeviceformat is declared as int, even though one of the multiplicands, sizeofstruct eckdcount, is a sizet. The expression trkcount rptmax sizeofstruct...

CVE-2026-80707

In the Linux kernel, the following vulnerability has been resolved: can: j1939: transport: j1939sessionfreshnew: initialize receive buffer Zero the allocated buffer in j1939sessionfreshnew to ensure it contains no residual data. While there is a potential performance impact if users allocate...