AZL-97289 CVE-2026-74722 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in btrfsdoencodedwrite Local fuzzing of 6.12.94 has found the following memory leak: Unreferenced object 0xffff888018050a80 size 64: comm "syz.0.17", pid 10297, jiffies 4294953601 hex dump first 32 bytes: 0...

AZL-97194 CVE-2026-74724 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74718

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

AZL-97341 CVE-2026-74715 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

AZL-97209 CVE-2026-74720 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...

AZL-97322 CVE-2026-74718 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: devlink: fix net namespace reference leak in reload devlinknlreloaddoit calls devlinknetnsget, which returns a net with a held reference. When the requested namespace differs from the current one and the reload action is not...

CVE-2026-74716

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix locally exploitable BUGON in amdxdnainsertpages In amdxdnainsertpages, vmflagsmod sets VMMIXEDMAP and clears VMPFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls...

CVE-2026-74719

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRMLINK and ADDLINKCONT in smcllceventhandler The SMCLLCCONFIRMLINK / SMCLLCADDLINKCONT branch in smcllceventhandler stores an incoming qentry into the local LLC flow without first checking...

CVE-2026-74720

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...

CVE-2026-74713

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

AZL-97179 CVE-2026-74719 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRMLINK and ADDLINKCONT in smcllceventhandler The SMCLLCCONFIRMLINK / SMCLLCADDLINKCONT branch in smcllceventhandler stores an incoming qentry into the local LLC flow without first checking...

AZL-97116 CVE-2026-74717 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

AZL-97314 CVE-2026-74713 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...

CVE-2026-74717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fwtracer, return NULL on create error Tracer creation can fail by returning either NULL or ERRPTR. The return value is stored without a check on the device, and users treat ERRPTR and NULL the same way. This also causes...

AZL-97064 CVE-2026-74714 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74708

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

CVE-2026-74709

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...