AZL-101120 CVE-2026-89900 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rcfreedevice call The commit dccc0c3ddf8f "media: rc: fix race between unregister and urb/irq callbacks" removed the implicit call to rcfreedevice from rcunregisterdevice. However, the...

AZL-101565 CVE-2026-89896 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cedrus: fix memory leak in cedrusinitctrls In cedrusinitctrls, the V4L2 control handler is initialized before allocating memory for ctx-ctrls. If this allocation fails, the function returns -ENOMEM without freeing the...

AZL-101478 CVE-2026-89894 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidiocsfmtvidcap and vidiocsstd change the device-wide dev-width / dev-norm but only refuse the change when the video queue dev-vidq is busy. The VBI queue...

AZL-101516 CVE-2026-89893 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netupciexit frees a netupcistate while its work item, netupreadcistatus, may still be pending or running on the system workqueue. The worker obtains the state with containerof...

AZL-101349 CVE-2026-89897 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cec: Serialize exclusive follower delivery cecreceivenotify reads the exclusive follower pointer without the adapter lock. Serialize the no-follower check and message delivery against mode changes and release...

AZL-101241 CVE-2026-89899 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: cec: disable delayed work before freeing an interrupted transmit cectransmitmsgfh drops adap-lock to wait for a blocking transmit in waitforcompletionkillable. If that wait is interrupted by a signal, canceldelayedworksync...

AZL-101220 CVE-2026-89887 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740remove function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a...

AZL-101174 CVE-2026-89892 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: defer audio-only extension registration The audio-only path registers extensions while probing the primary device. For a dual-TS board, this happens before devnext is created. The duplicate device inherits...

AZL-101504 CVE-2026-89891 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: em28xx: fix use-after-free of devnext-devlist on disconnect When a device with hasdualts=1 is probed and the isaudioonly path is taken, both dev and dev-devnext are added to the global em28xxdevlist via em28xxinitextension...

AZL-101361 CVE-2026-89888 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov02a10: fix endpoint parsing use-after-free The ov02a10checkhwcfg function calls fwnodehandleputep immediately after allocating and parsing the endpoint. However, it subsequently calls fwnodepropertyreadu32 using the...

AZL-101684 CVE-2026-89890 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007sndinit already takes a v4l2device reference for the ALSA side, but go7007sndremove drops it immediately after calling sndcardfreewhenclosed. That is too early when ...

AZL-101550 CVE-2026-89881 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: use vb2videounregisterdevice on remove to fix DMA leak rtl2832sdrremove runs on USB disconnect and clears dev-udev to NULL before any pending streaming teardown has run. When user space later closes its file...

AZL-101256 CVE-2026-89878 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: s2255: check firmware size before reading trailing marker s2255probe reads a 4-byte marker and version from the last 8 bytes of the firmware blob fw-datafwsize - 8 and fwsize - 4. If the firmware file is shorter than 8...

AZL-101604 CVE-2026-89880 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: release URBs and stream buffers on startstreaming failure rtl2832sdrstartstreaming calls rtl2832sdrallocstreambufs, rtl2832sdrallocurbs and rtl2832sdrsubmiturbs in sequence and shares a single err: label that...

AZL-101582 CVE-2026-89883 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rcregisterdevice succeeds, later probe failures must undo the registration with rcunregisterdevice. The current error path jumps to the allocation cleanup label an...

AZL-101184 CVE-2026-89884 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound...

AZL-101298 CVE-2026-89879 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255fillbuff memcpys vc-jpgsize bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc-jpgsize is taken verbatim from the S2255MARKERFRAME header the device...

AZL-101640 CVE-2026-89877 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: fix cleanup on resource allocation failure saa7164devsetup adds the device to the global saa7164devlist before requesting the PCI BAR memory regions. If getresources fails, saa7164devsetup decrements the device...

AZL-101612 CVE-2026-89872 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink In v4l2fwnodeparselink, the remote endpoint fwnode reference is acquired using fwnodegraphgetremoteendpoint. This reference is properly released in the error paths, but i...

AZL-101403 CVE-2026-89876 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: media: tda18250: fix possible integer overflow Integer overflow may occur, when variable exp equals to zero. Result of shift 1 exp - 1 may then leads to undefined behavior...