AZL-104808 CVE-2026-98157 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

AZL-104703 CVE-2026-98159 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...

AZL-104685 CVE-2026-98158 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

AZL-104772 CVE-2026-98148 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

AZL-104727 CVE-2026-98142 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

AZL-104232 CVE-2026-98130 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...

AZL-104460 CVE-2026-98129 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

AZL-104253 CVE-2026-98127 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3insertrange does not check if the new file size isize + len is valid. This allows FALLOCFLINSERTRANGE to bypass RLIMITFSIZE, exceed smaxbytes, or produce a size outside the lofft...

AZL-104856 CVE-2026-98131 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...

AZL-104874 CVE-2026-98134 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

AZL-104706 CVE-2026-98128 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

AZL-104756 CVE-2026-98124 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

AZL-104511 CVE-2026-98126 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

AZL-104240 CVE-2026-98121 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

AZL-104796 CVE-2026-98123 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

AZL-104277 CVE-2026-98125 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

AZL-104343 CVE-2026-98122 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbremotesrcdel vxlanmdbisvalidsource, which validates MDBEATTRSOURCE and every MDBEATTRSRCLIST member, accepts the all-zeros address. A source list is only accepted on a , G entry, whose...

AZL-104675 CVE-2026-98115 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

AZL-104396 CVE-2026-98111 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

AZL-104598 CVE-2026-98116 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation with an mmapcount check performed under the PCM stream lock, but the lock is released long before th...

AZL-104607 CVE-2026-98113 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to...

AZL-104481 CVE-2026-98114 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parsedacl silently accepts truncated ACEs and allocation failures, allowing setinfosec to continue with an incomplete ACL conversion. Return parsing and allocation errors to parsesecdesc so...

AZL-104412 CVE-2026-98109 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

AZL-104804 CVE-2026-98107 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

AZL-104427 CVE-2026-98108 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

AZL-104577 CVE-2026-98103 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

AZL-104472 CVE-2026-98104 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

AZL-104838 CVE-2026-98095 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afpacket: Don't cast tpackethdr.tplen to int in tpacketparseheader. syzbot reported BUG in socksendmsgnosec. 0 The problem is that tpacketparseheader casts user-provided tpackethdr.tplen, which is u32, to int. If the length is...

AZL-104409 CVE-2026-98097 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: Dont send random pad bytes in RESET/ACTIVATE messages The interface name is passed in a fixed length TIPCMAXIFNAME buffer. Replace the strcpydata, l-ifname with memcpy so that the pad bytes are actually written l-ifname is...

AZL-104559 CVE-2026-98096 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6srhrcv runs with skb-data at the Segment Routing Header SRH while skbnetworkheader points at the IPv6 header. When segmentsleft 0, ipv6srhrcv previously restored...

AZL-104502 CVE-2026-98098 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

AZL-104636 CVE-2026-98101 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

AZL-104745 CVE-2026-98099 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

AZL-104442 CVE-2026-98102 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...

AZL-104595 CVE-2026-98094 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

AZL-104367 CVE-2026-98090 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

AZL-104484 CVE-2026-98087 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

AZL-104622 CVE-2026-98086 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

AZL-104669 CVE-2026-98089 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

AZL-104841 CVE-2026-98091 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

AZL-104613 CVE-2026-98085 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

AZL-104243 CVE-2026-98088 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

AZL-104291 CVE-2026-98092 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing kfree...

AZL-104877 CVE-2026-98082 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

AZL-104561 CVE-2026-98081 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

AZL-104762 CVE-2026-98078 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

AZL-104688 CVE-2026-98083 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...

AZL-104858 CVE-2026-98079 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstdgetworkspace even though a workspace is free. When zstdallocworkspace fails, the task is queued on zwsm-wait and schedules unconditionall...

AZL-104294 CVE-2026-98084 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

AZL-104454 CVE-2026-98077 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...