AZL-98102 CVE-2026-80631 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject compressed segment that overflows the compressed input lzodecompressbio validates each on-disk segment length seglen only against the workspace cbuf size, not against the compressed input size compressedlen, th...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80614

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...

CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

CVE-2026-80597

In the Linux kernel, the following vulnerability has been resolved: mtd: maps: vmu-flash: fix NULL pointer dereference in initialization The mtdinfo contains a struct device, which must be linked to its parent. Without this, the initialization of the MTD fails with a NULL pointer dereference...

UBUNTU-CVE-2026-80690

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Initialize hba-rpmbs list in ufshcd Initialize the hba-rpmbs list in ufshcdallochost to prevent NULL pointer dereference in the device teardown path if ufsrpmbprobe fails...

UBUNTU-CVE-2026-80697

In the Linux kernel, the following vulnerability has been resolved: erofs: ensure valid fpath for page cache sharing Previously, backing files for page cache sharing were set up with fpath left as NULL only finode was valid. It worked, but a recent mincore fix relies on fpath.mnt and crashes foun...

UBUNTU-CVE-2026-80704

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, getssinfofromatombios uses calcpllcs-ctx-logger for logging. But calcpllcs-ctx is initialized only later in calcpllmaxvcoconstruct. Therefore, any...

CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

UBUNTU-CVE-2026-80605

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: prevent NULL pointer dereference in picolcdsendandwait In picolcdsendandwait, an integer overflow of the signed loop counter 'k' can theoretically lead to a NULL pointer dereference of 'rawdata'. If the loop execute...

UBUNTU-CVE-2026-80658

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Fix null-ptr-deref in dwdpremove Attempting to access driver data in the platform driver -remove callback may lead to a null pointer dereference since there is no guaranty that the component -bind callback...

UBUNTU-CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

UBUNTU-CVE-2026-80632

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996inittxqueues When MT76NPU and CONFIGNETMEDIATEKSOCWED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996inittxqueues will dereference a NULL WED pointer. Fix...

CVE-2026-80701

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the SVGACAP2CURSORMOB path -- the default on modern hosts -- accepts any size. When t...

UBUNTU-CVE-2026-80655

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent. However, the work structures zynqmppminitsuspendwork and...

UBUNTU-CVE-2026-80614

In the Linux kernel, the following vulnerability has been resolved: net: emac: Fix NULL pointer dereference in emacprobe Move devmrequestirq after devmplatformioremapresource so that dev-emacp is mapped before the interrupt handler can fire. An early interrupt hitting emacirq would dereference th...

UBUNTU-CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

CVE-2026-80679

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential NULL pointer dereference dasdreleasespace checks the implementation of the isese discipline function before calling it to determine if a given device is an ESE DASD. The current usage of the logical AND...

UBUNTU-CVE-2026-80689

In the Linux kernel, the following vulnerability has been resolved: tracing/mmiotrace: Add NULL check for mmiotracearray in logging functions mmiotracerw and mmiotracemapping retrieve mmiotracearray into tr and pass it to tracemmiotracerw and tracemmiotracemap. If these functions are invoked whil...

UBUNTU-CVE-2026-80691

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...