AZL-97206 CVE-2026-74656 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

CVE-2026-74660

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtnflog: pin the NFLOG backend nflogunregister runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebtnflog passes an explicit UL...

CVE-2026-74662

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

AZL-97287 CVE-2026-74658 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

AZL-97263 CVE-2026-74661 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154beaconworker reads local-beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the...

AZL-97346 CVE-2026-74654 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74649

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

AZL-97184 CVE-2026-74653 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74650

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74653

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

CVE-2026-74651

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

CVE-2026-74652

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...

CVE-2026-74647

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

CVE-2026-74639

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: re-anchor capture URBs on resubmission captureurbcomplete resubmits each capture URB without anchoring it: usbgeturburb; ret = usbsubmiturburb, GFPATOMIC; Anchoring is a property of a submission, not of the URB...

CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

CVE-2026-74643

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...

CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...