USN-8620-2 linux-azure-fips vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

CVE-2026-64259

A flaw was found in the Linux kernel's fuse-uring component. A local attacker could exploit a race condition by sending specially crafted requests before they are fully processed. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of...

CVE-2026-64516

A flaw was found in the Linux kernel's drm/amdgpu/vce1 component. The vulnerability arises from incorrect calculations of the VCE 1 firmware size and offsets, which could lead to an out-of-bounds access. This issue could potentially allow a local attacker to cause system instability or a denial o...

CVE-2026-64401

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a use-after-free, occurs when handling witness registrations. Specifically, a second mount for the same network share can cause the system to incorrectly reference a previously freed connection, leading to...

CVE-2026-64322

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. The udfloadsparablemap function incorrectly validates the length of the sparing table, treating it as a byte count instead of an entry count. This allows a local attacker, by providing a specially crafted UDF image, to...

CVE-2026-64474

A flaw was found in the Linux kernel's Virtual Function I/O VFIO device migration feature. The vfiomiggetnextstate function, responsible for managing device migration states, contains an infinite loop. This occurs when processing certain blocked transitions, causing the system to hold a driver...

CVE-2026-64421

A flaw was found in the Linux kernel's imx8-isi media driver. This use-after-free vulnerability occurs during the removal of the driver due to an incorrect order of cleanup operations. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution...

CVE-2026-64499

A flaw was found in the Linux kernel's ti-ads1119 Analog-to-Digital Converter ADC driver. This vulnerability occurs during the buffer pre-enable process, where a Power Management PM reference is not properly released if an I2C communication error occurs. This oversight can lead to a resource leak...

CVE-2026-64366

A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. This vulnerability occurs in the wacomwacqueueinsert function when handling incoming reports. Improper management of the kernel's internal buffer kfifo can lead to a slab-out-of-bounds write, allowing an attacker to...

CVE-2026-64440

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A remote attacker, by operating a malicious Access Point AP, can send a specially crafted 802.11 AssocResponse frame. This can trigger an out-of-bounds write vulnerability in the HTcapshandler function, leading to memory corruption...

CVE-2026-64534

A flaw was found in the Linux kernel's NVMe over TCP nvmet-tcp implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock...

CVE-2026-64550

A flaw was found in the Linux kernel's Qualcomm rmnet component. This vulnerability occurs because the system does not properly check the size of incoming network packets, specifically MAP frames, when a certain network feature ingress deaggregation is turned off. A remote attacker could exploit...

CVE-2026-64543

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A use-after-free vulnerability exists in the tipcdiscrcv function, where the discoverer object can be prematurely freed while still being referenced. An unprivileged local user can exploit this flaw by...

CVE-2026-64545

A flaw was found in the Linux kernel. The xdpmasterredirect function, which handles network packet redirection, does not properly check for a null pointer. This oversight allows a local attacker to trigger a null pointer dereference by sending a specially crafted XDP eXpress Data Path packet duri...

CVE-2026-64553

A flaw was found in the Linux kernel's packet sampling psample network module. This vulnerability, specifically within the PSAMPLEATTRDATA attribute handling, occurs because the nlaput function does not properly clear padding bytes. When the data length is not a multiple of four bytes,...

CVE-2026-64552

A flaw was found in the Linux kernel's virtio-net component. A malicious virtio backend can exploit an insufficient length check in the receivebig function, leading to an out-of-bounds write. This vulnerability can result in a denial of service DoS due to system instability or crashes...

CVE-2026-64547

A flaw was found in the Linux kernel's net1080 USB network adapter driver. A malicious NetChip 1080 device could send a specially crafted network frame with an invalid packet length. This could lead to an out-of-bounds read when processing the packet, causing a system crash and resulting in a...

CVE-2026-64555

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architecture, specifically affecting nested virtualization. The kvmhyphandlemops function, responsible for handling certain virtualization operations, incorrectly restored the SPSREL2 register. This occurred because...

CVE-2026-64540

A flaw was found in the Linux kernel's GeneLink GL620A USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus USB packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing...

CVE-2026-64551

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed error message, the system can be tricked into reading and the...