AZL-97811 CVE-2026-80529 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlogrecoverdquotcommitpass2 validates the recovered dquot with xfsdqblkverify and, on failure, sets error = -EFSCORRUPTED and jumps to outrelease. But outrelease unconditional...

CVE-2026-80523

In the Linux kernel, the following vulnerability has been resolved: clk: spacemit: k3: set hdma clock as critical HDMA clock is responsible for the internal TCM access path of X100 RISC-V core, so set the clock flag as critical to prevent it from being shut off, otherwise the Linux system will...

AZL-97814 CVE-2026-80521 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

CVE-2026-80520

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80521

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

UBUNTU-CVE-2026-80544

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing The zcryptmsgtype6sendep11cprb function uses fragile struct overlays to access and modify the domain field in the EP11 CPRB payload, creating maintainability and...

UBUNTU-CVE-2026-80525

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...

UBUNTU-CVE-2026-80521

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-80545

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrbmsgtotype6ep11cprbmsgx function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11cprb structure and...

CVE-2026-80567

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue Previously, rmif54bufferqueue waited for the worker thread to finish but ignored whether it succeeded. If the worker failed e.g., due to a timeout or register read...

CVE-2026-80564

In the Linux kernel, the following vulnerability has been resolved: gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as follows: sudo ./testptp -d /dev/ptp0 -f 0 551.943697 BUG: kernel NULL...

CVE-2026-80527

In the Linux kernel, the following vulnerability has been resolved: ceph: fix hanging cephgetcaps with stale mdswanted A reader can hang forever in cephgetcaps when the client no longer holds FILERD, but local cap state still says that the capability is already wanted via mdswanted. One way to...

CVE-2026-80541

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEMCREATE domain combinations AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA,...

CVE-2026-80528

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current-journalinfo handlereply stores a cephmdsrequest pointer in current-journalinfo while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct...

CVE-2026-80535

In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to...

CVE-2026-80525

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup The ipcconfigdata buffer for copier widgets is built once during ipcprepare called from sofpcmsetupconnectedwidgets and cached for reuse. For host copiers...

CVE-2026-80532

In the Linux kernel, the following vulnerability has been resolved: xfs: fix another iunlink infinite loop bug in online fsck xrepiunlinkresolvebucket is supposed to reconstruct as much of the incore prev and next unlinked list pointers based on what it finds on disk and in memory before we move ...

CVE-2026-80579

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fbinfo-mode before deleting a videomode fbsetvar can delete a mode from info-modelist when userspace passes FBACTIVATEINVMODE through FBIOPUTVSCREENINFO. The code checks that the mode being deleted is not the current...