AZL-96534 CVE-2026-72200 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

CVE-2026-72088

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

CVE-2026-72277

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

UBUNTU-CVE-2026-72277

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

UBUNTU-CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

CVE-2026-72088

In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the command. Add the missing error cleanup by unmapping the IOACCEL2 SG...

UBUNTU-CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

CVE-2026-74396

CVE-2026-74396 affects the Linux kernel in the RDMA/mlx5 stack. The issue occurs in the path that allocates and DMA maps an XLT buffer via mlx5r_umr_create_xlt() and releases it through mlx5r_umr_unmap_free_xlt(). If mlx5_odp_populate_xlt() encounters an error, its error path previously returned ...

CVE-2026-74396 RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure mlx5rumrupdatexlt allocates and DMA maps an XLT buffer with mlx5rumrcreatexlt. The buffer is released by the common cleanup path through mlx5rumrunmapfreexlt. After...

CVE-2026-74358 ext4: fix fast commit wait/wake bit mapping on 64-bit

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

CVE-2026-74358 ext4: fix fast commit wait/wake bit mapping on 64-bit

In the Linux kernel, the following vulnerability has been resolved: ext4: fix fast commit wait/wake bit mapping on 64-bit On 64-bit, ext4 dynamic inode states live in the upper half of iflags, and ext4testinodestate applies the corresponding +32 offset. The fast-commit wait and wake paths...

CVE-2026-74309 vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74309

The CVE-2026-74309 entry documents a Linux kernel issue in the vdpa/octeon_ep component where interrupt handling incorrectly mapped IRQs to rings. The root cause is assuming irq - irqs[0] to locate the IRQ index; the fix updates the code to look up the IRQ index within oct_hw->irqs, allowing n...

EUVD-2026-59456

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74309 vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler

In the Linux kernel, the following vulnerability has been resolved: vdpa/octeonep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in octhw-irqs instead of assuming irq - irqs0. This supports non-contiguous IRQ numbers and avoids incorrect ring indexing when irqs0 is not the ba...

CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-72478 fs/ntfs3: add bounds check to run_get_highest_vcn()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping-pairs buffer without any length bound, relying solely on a 0x00 terminator to stop. A crafted $LogFile UpdateMappingPairs record whose...