AZL-109188 CVE-2026-98655 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

CVE-2026-98656

In the Linux kernel, the following vulnerability has been resolved: iio: trigger: cancel reenablework before freeing trigger iiotriggernotifydoneatomic defers -reenable into trig-reenablework on the system workqueue, and the worker dereferences the owning trigger through containerof. Nothing...

CVE-2026-98655

In the Linux kernel, the following vulnerability has been resolved: perf: Require kernel access for text poke events Perf events with excludekernel=1 can be opened without kernel perf access. However, excludekernel does not suppress text-poke sideband records. Every PERFRECORDTEXTPOKE is marked...

CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

AZL-109206 CVE-2026-98647 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

AZL-108839 CVE-2026-98644 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

AZL-108797 CVE-2026-98646 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...

AZL-109416 CVE-2026-98640 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

AZL-109311 CVE-2026-98642 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98639

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

CVE-2026-98645

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98643

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98642

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98644

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

CVE-2026-98646

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...

CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

AZL-109140 CVE-2026-98643 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

AZL-108921 CVE-2026-98632 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...