CVE-2026-45720

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

CVE-2026-45720

Omni (by Sidero Labs), a platform for managing Kubernetes on bare metal, VMs, or cloud, contains a TOCTOU race condition in SAML.getSession (internal/pkg/auth/interceptor/saml.go). The Used flag on a SAMLAssertion is checked and marked in two separate non-atomic operations, allowing concurrent re...

CVE-2026-45720 Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

CVE-2026-93203

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadvblaaddclaim is used to add claims and modify the backbone of claims for CLAIM frames from remote backbones and local packets. When it handles a claim, it needs...

AZL-102131 CVE-2026-93203 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadvblaaddclaim is used to add claims and modify the backbone of claims for CLAIM frames from remote backbones and local packets. When it handles a claim, it needs...

AZL-103035 CVE-2026-93204 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is...

CVE-2026-93170

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

DEBIAN-CVE-2026-93170

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

AZL-103028 CVE-2026-93170 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

AZL-101855 CVE-2026-93150 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

AZL-102957 CVE-2026-93149 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

AZL-102888 CVE-2026-93138 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux bpfgetbtfvmlinux lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing...

DEBIAN-CVE-2026-93138

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux bpfgetbtfvmlinux lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing...

CVE-2026-93138

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix vmlinux BTF prep race in bpfgetbtfvmlinux bpfgetbtfvmlinux lazily parses the vmlinux BTF under the bpfverifierlock, but publishes the result through a plain store and re-checks it through a plain lockless load. Nothing...

AZL-102648 CVE-2026-93131 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-privacy: Fix race condition Accessing priv-featurespresent needs to happen with the list mutex being held, otherwise priv can be freed at any moment...

AZL-102527 CVE-2026-93092 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

AZL-102710 CVE-2026-93073 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

AZL-102750 CVE-2026-93052 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

AZL-102329 CVE-2026-93040 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize channel state checks pause and resume read and update channel state without holding vc.lock, while the interrupt handlers update the same state under it. Take the same lock around those state checks ...

AZL-102653 CVE-2026-93041 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Serialize abort state updates dwedmaabortinterrupt drops vc.lock before changing request and status. issuepending can acquire the lock in that small window, observe the old busy state, and skip starting queued...