CVE-2026-64493

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mpl115: fix runtime PM leak on read error mpl115readraw takes a runtime PM reference with pmruntimegetsync before reading the processed pressure or raw temperature, but on the read error path it returns without...

CVE-2026-64499

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable ads1119triggeredbufferpreenable resumes the device with pmruntimeresumeandget before starting a conversion. If i2csmbuswritebyte fails, the function returns the erro...

CVE-2026-64494

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: fix runtime PM leak on read error gp2ap002readraw calls pmruntimegetsync before reading the lux value, but if gp2ap002getlux fails, it returns directly. This skips the pmruntimeputautosuspend call at the "ou...

CVE-2026-64485

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind sndcomprtasknew allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task...

CVE-2026-64480

In the Linux kernel, the following vulnerability has been resolved: ALSA: ice1712: check sndctlnew1 return value sndctlnew1 can return NULL when memory allocation fails. The ice1712 driver calls sndctlnew1 without checking the return value before dereferencing the pointer in multiple places...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64460

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriovrestorevfrebarstate uses the VF Resizable BAR Control register to decide how many VF BARs to restore nbars and which VF BAR each iteration addresses baridx. baridx indexes...

CVE-2026-64447

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

CVE-2026-64427

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64400

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbdvfspathlookup enforces LOOKUPBENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using...

AZL-93767 CVE-2026-64386 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

CVE-2026-64385

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64365

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

CVE-2026-64370

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

AZL-93743 CVE-2026-64350 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

CVE-2026-64350

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64301

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

CVE-2026-64308

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPVLEKLOAD Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and...