AZL-104379 CVE-2026-97564 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

AZL-104741 CVE-2026-97572 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate RX ring init failures in bnxtinitnic bnxtinitrxrings returns an error when bnxtalloconerxring fails, but bnxtinitnic discards that return value and calls bnxtinitchip, which enables TPA. If an allocation fails,...

AZL-104660 CVE-2026-97567 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...

AZL-104667 CVE-2026-97566 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

AZL-104508 CVE-2026-97562 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

AZL-104691 CVE-2026-97559 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

AZL-104187 CVE-2026-97560 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

AZL-104867 CVE-2026-97561 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

AZL-104175 CVE-2026-97558 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

AZL-104543 CVE-2026-97557 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

AZL-104279 CVE-2026-97563 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

AZL-104327 CVE-2026-97556 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

AZL-104523 CVE-2026-97555 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

AZL-104337 CVE-2026-97554 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

AZL-104478 CVE-2026-97542 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrepagflfill LOLLM also points out that the xagbbitmapset call in xrepagflfill can fail, but we don't check the result of xagbbitmapwalk, so we silently drop the error and proceed with inconsiste...

AZL-104385 CVE-2026-97539 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is...

AZL-104490 CVE-2026-97541 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: don't store usbdeviceid usbdeviceid is not guaranteed to live longer than probe due to presence of dynamic ID. All information apart from driverdata can be easily retrieved from usbdevice, so just store driverdata...

AZL-104564 CVE-2026-97540 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

AZL-104532 CVE-2026-97534 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: f2fs: accurately adjust freesections during freesegmentrange In freesegmentrange, MAINSECSsbi is temporarily reduced by secs to restrict block allocation to the safe remaining main area while valid blocks in the truncated range a...

AZL-104340 CVE-2026-97536 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxxmsixrspq schedules qladowork via queueworkha-wq, &qpair-qwork. qladowork dereferences the qpair vha, rsp and takes...

AZL-104693 CVE-2026-97531 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition format-1 handling walks ha-vplist under vportslock, takes a vrefcount on the matching vport and calls qlaupdatehostmap to register its...

AZL-104634 CVE-2026-97529 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

AZL-104616 CVE-2026-97535 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte 128-bit array in both vpctrlentry24xx and vpctrlentry24xxext...

AZL-104439 CVE-2026-97532 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

AZL-104723 CVE-2026-97537 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

AZL-104160 CVE-2026-97530 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature qla27xxcopymultiplepkt and qla27xxcopyfpinpkt poll rspq-ringptr-signature for RESPONSEPROCESSED 0xDEADDEAD to decide whether the next continuation IOCB has arrive...

AZL-104618 CVE-2026-97523 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: close race between scheduler and state change The mptcp scheduler may race with subflow sockets state change: data transmission on the selected socket may fail and a later release could try to use mssnow reset to 0 for a...

AZL-104583 CVE-2026-97524 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid unneeded actions on subflow reset Once in a blue moon, the mptcp receive path can recursively call mptcpdataready via state change under unlucky error conditions, and then try to hold the data lock again. Break the...

AZL-104226 CVE-2026-97527 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock The fcport-unsolctxhead list is modified from several contexts without a common lock. Entries are added in qla2xxxprocesspurlsiocb from the response queue ISR...

AZL-104567 CVE-2026-97522 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix bad accounting in mptcpsubflowpushpending If subflowpushpending errors out we should avoid updating the copied byte counters, to avoid mismatch push call later on...

AZL-104436 CVE-2026-97528 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qlanvmexmtlsrsp obtains uctx, which was linked into fcport-unsolctxhead by qla2xxxprocesspurlsiocb and is still linked when the NVMe transport calls back to...

AZL-104081 CVE-2026-53493 affecting package moby-containerd-cc 1.7.7-17

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runtime instability...

AZL-105123 CVE-2026-53493 affecting package containerd2 2.3.4-1

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runtime instability...

AZL-106800 CVE-2026-88386 affecting package libsndfile 1.2.2-5

libsndfile 1.2.2 contains a misaligned memory access issue in psfbinheaderreadf while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int and perform a 4-byte store. This results in undefined behavior leading to deni...

AZL-105107 CVE-2026-96748 affecting package python-pymongo 4.2.0-9

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

AZL-105110 CVE-2026-96749 affecting package python-pymongo 4.2.0-9

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...

AZL-105113 CVE-2026-96747 affecting package python-pymongo 4.2.0-9

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...

AZL-103805 CVE-2026-97520 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quotainit qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2quotainit. This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot...

AZL-103757 CVE-2026-97521 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used gfs2qdsearchbucket, which takes a lockref reference via...

AZL-103961 CVE-2026-97519 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix null pointer dereference in devcoredump cleanup In xedevcoredumpsnapshotfree, ss-gt may be NULL when the snapshot was never fully populated e.g., when cleanup is triggered without a prior capture. Guard the...

AZL-103622 CVE-2026-97514 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handledynamicresolution change requires that the statelock be acquired based on the lockdepassertheld. However, the handledynamicresolutionchange call in...

AZL-103733 CVE-2026-97516 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Add NULL check for chip-edccath in rtwfwadaptivityresult It was recently reported that rtwfwadaptivityresult in fw.c dereferences rtwdev-chip-edccath without a NULL check. The issue is that devices with the 8821CE ch...

AZL-103937 CVE-2026-97517 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject beacons with bad HE operation The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this...

AZL-103592 CVE-2026-97518 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate entries in wiphy-ciphersuites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them...

AZL-104036 CVE-2026-97513 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2mctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2mctx release and wave5release function removing stream instance from list of...

AZL-103820 CVE-2026-97515 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 On NPCM845, when a target on the I3C bus gets stuck holding SDA low, the controller reports a false Master Request MR in-band interrupt event. The driver handles...

AZL-103796 CVE-2026-97512 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM The runtime PM functions had incomplete error handling that could leave the system in an inconsistent state. If any operation failed midway through suspend or resume...

AZL-103970 CVE-2026-97510 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Release request if tbcfgrequest fails in tbxdomainresponse If tbcfgrequest fails setting up the request for example the control channel is shut down already it returns an error without calling the callback. To avoid...

AZL-103544 CVE-2026-97503 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers /proc/irq// directory names are built in char name10 buffers with sprintfname, "%u", irq. Ten-digit IRQ numbers already need 11 bytes including the traili...

AZL-103547 CVE-2026-97509 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed because we release the service ID in tbservicerelease and the ID array is owned by the parent XDomain...