AZL-93449 CVE-2026-64471 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This...

AZL-93764 CVE-2026-64474 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

AZL-93912 CVE-2026-64465 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

AZL-93786 CVE-2026-64462 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove. If pcihostprobe fails, the handler and INTx IRQ domain remain set even though the...

AZL-93866 CVE-2026-64456 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copydata randomrecvdone stores the device-reported used.len directly into vi-dataavail. copydata then indexes vi-data using vi-dataidx advanced by previous copydata calls and issue...

AZL-93926 CVE-2026-64452 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

AZL-93779 CVE-2026-64450 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

AZL-93782 CVE-2026-64448 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

AZL-93710 CVE-2026-64444 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

AZL-93596 CVE-2026-64443 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

AZL-93680 CVE-2026-64441 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

AZL-93584 CVE-2026-64435 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

AZL-93545 CVE-2026-64434 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

AZL-93677 CVE-2026-64429 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use rawspinlockt in the irq startup path sprdeicirqunmask enables the GPIO IRQ and then updates controller state through sprdeicupdate, which takes sprdeic-lock with spinlockirqsave. The callback can be reached fr...

AZL-93665 CVE-2026-64433 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

AZL-93737 CVE-2026-64423 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

AZL-93581 CVE-2026-64422 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...

AZL-93617 CVE-2026-64428 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

AZL-93488 CVE-2026-64425 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

AZL-93455 CVE-2026-64424 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

AZL-93930 CVE-2026-64413 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

AZL-93788 CVE-2026-64408 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnepaddconnection reads the L2CAP connection without holding the channel lock, then passes its HCI device to registernetdev. Controller teardown can clear and relea...

AZL-93536 CVE-2026-64406 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that reference before btacceptunlink, leaving only the queue reference...

AZL-93452 CVE-2026-64405 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: Fix null ptr deref in hciabortconn hciabortconn read hciskbeventhdev-sentcmd when a connection was pending, but hdev-sentcmd can be NULL while reqstatus is still HCIREQPEND, leading to a NULL pointer dereferen...

AZL-93527 CVE-2026-64412 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to requestmodule...

AZL-93518 CVE-2026-64409 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix infinite loop in btmtksdiotxrxwork Every once in a while we see a hung btmtksdioflush task: INFO: task kworker/u17:0:189 blocked for more than 122 seconds. cancelworktimer+0x3f4/0x460...

AZL-93461 CVE-2026-64411 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

AZL-93704 CVE-2026-64403 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2capgetconfopt derives the option length from the attacker-controlled opt-len field and immediately dereferences opt-val as u8, getunalignedle16 or...

AZL-93524 CVE-2026-64387 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query directory replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2querydirectoryinit fails before the next send, cleanup retains the previous buffer...

AZL-93753 CVE-2026-64388 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership chown and group chgrp modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFSMOUNTCIFSACL or CIFSMOUNTMODEFROMSID were also explicitly...

AZL-93767 CVE-2026-64386 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix queryinfo replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2queryinfoinit fails before the next send, cleanup retains the previous buffer type and...

AZL-93854 CVE-2026-64380 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

AZL-93671 CVE-2026-64382 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

AZL-93734 CVE-2026-64383 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fails before cifssendrecv stores a replacement...

AZL-93647 CVE-2026-64379 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

AZL-93893 CVE-2026-64385 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2ioctl replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2ioctlinit fails before the next send, cleanup retains the previous buffer type and fre...

AZL-93632 CVE-2026-64384 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails before the next send, cleanup retains the previous buffer type and...

AZL-93437 CVE-2026-64381 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

AZL-93500 CVE-2026-64374 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RTPUSHIPI be default off for non PREEMPTRT RT migration is done aggressively. When a CPU schedules out a high priority RT task for a lower priority task, it will look to see if there's any RT tasks that are waiting...

AZL-93935 CVE-2026-64375 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

AZL-93692 CVE-2026-64377 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

AZL-93840 CVE-2026-64371 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

AZL-93914 CVE-2026-64372 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in OSC evaluation pcccpufreqdoosc calls acpievaluateobject twice for the two-phase OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged...

AZL-93945 CVE-2026-64378 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

AZL-93551 CVE-2026-64373 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: Fix hotplug-suspend race during reboot During system reboot, cpufreqsuspend is called via the kernelrestart - deviceshutdown path. Unlike the normal system suspend path, the reboot path does not call freezeprocesses, so...

AZL-93467 CVE-2026-64368 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to origsize when only red zoning is enabled When init zeroing on allocation is requested, for kmalloc we generally have to zero the full object size even if a smaller size is requested, in order to...

AZL-93861 CVE-2026-64370 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in docpunanosleep error path In docpunanosleep, posixcputimercreate takes a pid reference via getpid and stores it in timer.it.cpu.pid. If the subsequent posixcputimerset call fails, the...

AZL-93878 CVE-2026-64364 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mtioflags mtioflags is a single unsigned long, but mtprocessslot, mtreleasependingpalms and mtreleasecontacts use it as a per-slot bitmap indexed by the slot number. That slot numb...

AZL-93776 CVE-2026-64362 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lgg15data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lgg15event and lgg15v2event do it on th...

AZL-93554 CVE-2026-64363 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...