AZL-98168 CVE-2026-80703 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFDIOCDBGTRAPDISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without...

AZL-98078 CVE-2026-80704 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80699

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW bit in the LR. The extra deactivation would be harmless but can hit a...

CVE-2026-80700

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

CVE-2026-80702

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...

AZL-98184 CVE-2026-80700 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate external BO copy bounds for both stride paths vmwexternalbocopy trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy bound was clamped after...

CVE-2026-80696

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Fix reading the minimum alarm voltage Coverity reports an out-of-bounds access when reading the minimum alarm voltage for the VGPIO channel. Add the missing return statement to fix the problem...

CVE-2026-80703

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFDIOCDBGTRAPDISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without...

CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

AZL-98153 CVE-2026-80698 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease each call kfree on the enclosing struct. The...

AZL-98051 CVE-2026-80702 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix guestmemorydirty bitfield clobbered as size Two sites in vmwgfxresource.c assign boolean literals to res-guestmemorysize, which is an unsigned long allocation-size field; the intended target is the adjacent...

CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

CVE-2026-80693

In the Linux kernel, the following vulnerability has been resolved: idpf: bound interrupt-vector register fill to the allocated array idpfgetregintrvecs fills the caller-allocated regvals array from the VIRTCHNL2OPALLOCVECTORS reply in adapter-reqvecchunks, bounding its inner loop only by the...

CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

AZL-98084 CVE-2026-80692 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

AZL-98066 CVE-2026-80694 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: pass eth to mtkhandleirqrx in pollcontroller mtkhandleirqrx expects a struct mtketh matching the requestirq cookie, but mtkpollcontroller incorrectly passed the netdevice . Calling ndopollcontroller with...

CVE-2026-80686

In the Linux kernel, the following vulnerability has been resolved: mm: migratedevice: fix ptepfn/ptedirty called on non-present PTE ptepfn and ptedirty have undefined behaviour when called on a non-present PTE. In migratevmacollectpmd, these functions may be invoked on non-present entries e.g.,...

CVE-2026-80695

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

CVE-2026-80688

In the Linux kernel, the following vulnerability has been resolved: riscv: drop init from veccheckunalignedaccessspeedallcpus This function runs within a kthread and need not necessarily finish before system finishes boot and freeinitmem unmaps the .init.text section. This function makes calls to...