AZL-97686 CVE-2026-80568 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80569

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmif54work reads a diagnostics report from the device into f54-reportdata, sizing the transfer with rmif54getreportsize: reportsize = rmif54getreportsizef5...

CVE-2026-80545

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

CVE-2026-80546

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80580

CVE-2026-80580 is a buffer overflow in the Linux kernel fbdev subsystem. The function mode_string() uses snprintf(), which can return a value larger than the remaining buffer space. show_modes() accumulates this return value without checking whether the offset has reached PAGE_SIZE , allowing the...

CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulates the return value into i without checking whether i has reached...

CVE-2026-80571

CVE-2026-80571 affects the Linux kernel on powerpc/pseries systems, specifically the papr-phy-attest driver. In the function papr_phy_attest_create_handle() , the field params->cmd.length is not validated before use, which can result in a buffer overflow . The driver also fails to free params ...

CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak In paprphyattestcreatehandle, the params-cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is...

CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80569

CVE-2026-80569 is a heap buffer overflow in the Linux kernel's synaptics-rmi4 input driver. The F54 diagnostics function allocates its report_data buffer based on F54 electrode counts, but computes the transfer size from F55 electrode counts. A malicious or malfunctioning RMI4 device that reports...

CVE-2026-80570

CVE-2026-80570 is a heap buffer overflow in the Linux kernel's synaptics-rmi4 input driver. In rmi_f54_work(), an error during report request or command verification jumped to the error label, bypassing the abort label where f54->report_size was normally zeroed. The stale payload size then cau...

CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmif54work, if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where...

CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80568

This Linux kernel vulnerability affects the synaptics-rmi4 input driver. When the diagnostic report type is changed mid-stream via VIDIOC_S_INPUT , the report size can change while V4L2 buffers remain allocated at their original stream-start size, leading to a heap buffer overflow if the new size...

CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block sinput when F54 queue is busy Changing the input diagnostic report type mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input whil...

CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...

CVE-2026-80546

CVE-2026-80546 affects the s390/zcrypt subsystem of the Linux kernel, specifically the xcrb_msg_to_type6cprb_msgx() function. Three related input-validation flaws allow a local attacker with low privileges to trigger: (1) integer overflow during CEIL4 alignment, leading to undersized buffer alloc...

CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve CCA CPRB length and overflow checks The xcrbmsgtotype6cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Integer overflow after CEIL4 alignment: Signed int variables could...