2912 matches found
AZL-100136 CVE-2026-80951 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: i3c: master: svc: bound IBI payload to the requested maxpayloadlen svci3cmasterhandleibi reads the IBI payload from the RX FIFO into the IBI slot. The loop is bounded by the hardware FIFO size SVCI3CFIFOSIZE, not by the slot size...
AZL-100298 CVE-2026-80947 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rxurbwq on stop rtl8xxxu arms rxurbwq from the RX completion path: rtl8xxxurxcomplete hands the URB to rtl8xxxuqueuerxurb, which queues it on rxurbpendinglist and, once the list grows past...
AZL-100217 CVE-2026-80949 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix memory leak in brcmfsdioreadcontrol The memory allocated for buf is not freed in some of the error paths in brcmfsdioreadcontrol. Fix that by adding vfree calls. arend: rework as suggested by Johannes...
AZL-100657 CVE-2026-80948 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwlopmodedvmstart In iwlopmodedvmstart, jumping to outfreeeeprom currently bypasses the outfreeeepromblob label. Consequently, error paths triggered after successfully parsing the EEPROM fre...
AZL-100709 CVE-2026-80941 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...
AZL-100650 CVE-2026-80944 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmdnode-databuf. Several callers pass stack-allocated objects there. If waiteventinterruptibletimeout ...
AZL-100602 CVE-2026-80938 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex mt7615suspend acquired the mt76 mutex and then called canceldelayedworksync on macwork. mt7615macwork acquires the same mutex via mt7615mutexacquire at the top o...
AZL-100734 CVE-2026-80933 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during...
AZL-100416 CVE-2026-80937 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915mcugeteeprom copies a fixed EFUSE block into the driver's dev-mt76.eeprom.data buffer at the offset reported by the MCU response res-addr, a...
AZL-100383 CVE-2026-80932 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those item...
AZL-100748 CVE-2026-80935 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996mcugeteeprom derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response event-addr, a device-controlled le32 a...
AZL-100532 CVE-2026-80930 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: tpm: tpmi2cnuvoton: disable IRQ on wait timeout i2cnuvotonwaitforstat enables the IRQ before waiting for the interrupt handler to report a status change. If the wait times out, or is interrupted before the handler runs, the...
AZL-100286 CVE-2026-80931 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1f19i2cmastertransfer is the masterxfer for the DS28E17 1-Wire to I2C bridge. On an I2CMRECVLEN read, it takes the length from the device. The downstream slave puts a...
AZL-100172 CVE-2026-80928 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...
AZL-100751 CVE-2026-80926 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...
AZL-101727 CVE-2026-89329 affecting package device-mapper-multipath 0.9.6-1
A flaw was found in multipathd. A local attacker with access to the multipathd UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the multipathd listener thread to block, leading to a Denial of Service DoS where...
AZL-103383 CVE-2026-87910 affecting package python3 3.12.14-2
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
AZL-103386 CVE-2026-78807 affecting package wpa_supplicant 2.10-3
An issue in wpasupplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...
AZL-101736 CVE-2026-18495 affecting package libtiff 4.6.0-14
A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the tiff2pdf utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit StripByteCounts value to be truncated to a 32-bit...
AZL-101778 CVE-2026-87776 affecting package python-tensorboard 2.16.2-6
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...
AZL-101742 CVE-2026-89147 affecting package net-snmp 5.9.5.2-1
Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smuxaccept performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the...
AZL-101739 CVE-2026-77159 affecting package libvirt 11.9.0-1
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
AZL-101111 CVE-2026-13326 affecting package qt6-qtconnectivity 6.5.7-1
An out-of-bounds read in Qt NFC's language code length parsing allows a physically proximate attacker to cause a denial of service or limited memory disclosure via a crafted NFC tag...
AZL-101766 CVE-2026-89161 affecting package php 8.3.33-1
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101745 CVE-2026-89160 affecting package nmap 7.95-5
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-100056 CVE-2026-89160 affecting package pcre2 for versions less than 10.48-1
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-101787 CVE-2026-89160 affecting package qtbase 6.6.3-5
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-101817 CVE-2026-89160 affecting package rust 1.96.1-1
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-100053 CVE-2026-89161 affecting package pcre2 10.42-3
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101790 CVE-2026-89161 affecting package qtbase 6.6.3-5
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101802 CVE-2026-89161 affecting package rust 1.75.0-31
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101823 CVE-2026-89161 affecting package rust 1.96.1-1
In PCRE2 before 10.48, pcre2jitmatch mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur...
AZL-101763 CVE-2026-89160 affecting package php 8.3.33-1
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-101799 CVE-2026-89160 affecting package rust 1.75.0-31
PCRE2 before 10.48 has a pcre2match out-of-bounds read during the PCRE2MATCHINVALIDUTF matching of an invalid UTF subject...
AZL-101814 CVE-2026-89158 affecting package rust for versions less than 1.96.0-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-101793 CVE-2026-89158 affecting package qtbase 6.6.3-5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-100062 CVE-2026-89158 affecting package pcre2 for versions less than 10.48-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-101117 CVE-2026-89158 affecting package ripgrep 13.0.0-14
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-101751 CVE-2026-89158 affecting package nmap 7.95-5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-101826 CVE-2026-89157 affecting package rust for versions less than 1.96.0-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
AZL-101760 CVE-2026-89157 affecting package php 8.3.33-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
AZL-101748 CVE-2026-89157 affecting package nmap 7.95-5
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
AZL-100059 CVE-2026-89157 affecting package pcre2 for versions less than 10.48-1
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
AZL-101805 CVE-2026-89158 affecting package rust 1.75.0-31
PCRE2 before 10.48, on 32-bit platforms, has a pcre2compile32 integer overflow and resultant out-of-bounds write...
AZL-101811 CVE-2026-89157 affecting package rust 1.75.0-31
PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern...
AZL-101796 CVE-2026-89156 affecting package qtbase 6.6.3-5
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...
AZL-101754 CVE-2026-89156 affecting package nmap 7.95-5
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...
AZL-101808 CVE-2026-89156 affecting package rust 1.75.0-31
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...
AZL-100065 CVE-2026-89156 affecting package pcre2 for versions less than 10.48-1
PCRE2 before 10.48 has a pcre2match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data...