CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

AZL-108836 CVE-2026-98602 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

CVE-2026-98602

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

AZL-108629 CVE-2026-98578 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

AZL-108969 CVE-2026-98582 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98582

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98578

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ISO15693 inventory length The ISO15693 inventory helper removes a two-byte prefix without checking that it exists, then accepts a one-byte remainder before reading data1 as the DSFID. Require the prefix an...

AZL-108927 CVE-2026-98575 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

AZL-109277 CVE-2026-98576 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98576

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98575

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

AZL-108849 CVE-2026-98545 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

AZL-109041 CVE-2026-98531 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

AZL-108915 CVE-2026-98532 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...