AZL-93090 CVE-2026-15811 affecting package kronosnet 1.29-3

A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after...

AZL-92862 CVE-2026-64190 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

AZL-92855 CVE-2026-64192 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

AZL-92858 CVE-2026-64205 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

AZL-92865 CVE-2026-64206 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendingrxwork before taking conn-lock l2capconndel takes conn-lock and then calls cancelworksync for pendingrxwork. processpendingrx takes the same mutex, so teardown can deadlock against the worker it is...

AZL-92868 CVE-2026-64189 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

AZL-92853 CVE-2026-64187 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...

AZL-92847 CVE-2026-26197 affecting package hdf5 for versions less than 1.14.6-4

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the...

AZL-93000 CVE-2026-26081 affecting package haproxy for versions less than 2.9.11-8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

AZL-92850 CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If H5Igetname is invoked on a group id with 0 for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if H5Igetname is invoked in a way...

AZL-93009 CVE-2026-16277 affecting package rpcbind for versions less than 1.2.9-1

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this...

AZL-93006 CVE-2026-12080 affecting package qemu 10.1.0-1

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

AZL-92898 CVE-2026-15813 affecting package kronosnet 1.29-3

A vulnerability was found in the network packet de-fragmentation engine of kronosnet Version affected = 1.34. The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can exploit this lack of verification by transmitting malformed packets...

AZL-92994 CVE-2026-15588 affecting package glib for versions less than 2.78.6-11

A denial-of-service and resource exhaustion vulnerability exists within the GDBus component of GLib. The gdbusauth authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input...

AZL-92733 CVE-2026-64160 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in -remoteisize and -zeropoint Fix potential tearing in using -remoteisize and -zeropoint by copying isizeread and isizewrite and using the same seqcount as for isize. We need to make sure that...

AZL-92796 CVE-2026-64154 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

AZL-92826 CVE-2026-64146 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: erofs: fix metabuf leak in inode xattr initialization commit bb88e8da0025 "erofs: use meta buffers for xattr operations" converted xattr operations to use on-stack erofsbuf instances. erofsinitinodexattrs uses such a metabuf whil...

AZL-92727 CVE-2026-64133 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache findcontrol to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it...

AZL-92754 CVE-2026-64117 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

AZL-92802 CVE-2026-64112 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lockdwork draining on unmap Given how rbdlockaddrequest and rbdimgexclusivelock are written, lockdwork may be requeued more than it's actually needed: for example in case a new I/O request comes in while ...

AZL-92760 CVE-2026-64097 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

AZL-92769 CVE-2026-64077 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: move to two-stage removal scheme Like previous patches for xtables, follow same pattern in ebtables. We can't reuse xt helpers: ebttable struct layout is incompatible. table-ops assignment is now done while...

AZL-92763 CVE-2026-64078 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: add and use xtablesunregistertableexit Previous change added xtablesunregistertablepreexit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that ...

AZL-92724 CVE-2026-64079 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

AZL-92829 CVE-2026-64082 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

AZL-92805 CVE-2026-64076 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: ebtables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nfregistersockopt completes, the sockopts are exposed...

AZL-92807 CVE-2026-64060 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

AZL-92718 CVE-2026-64038 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

AZL-92721 CVE-2026-64036 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

AZL-92814 CVE-2026-64017 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blkmqfreeplugrqs, freeing the cachedrqs. This...

AZL-92817 CVE-2026-63999 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...

AZL-92772 CVE-2026-63983 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

AZL-92823 CVE-2026-63974 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

AZL-92820 CVE-2026-63978 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

AZL-92783 CVE-2026-63961 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: validate count before reading Status Update VDO A broken/malicious device can send the incorrect count for a status update VDO, which will cause the kernel to read uninitialized stack data and se...

AZL-92775 CVE-2026-63964 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: ccg: reject firmware images without a ':' record header doflash locates the first .cyacd record with p = strnchrfw-data, fw-size, ':'; while p eof s = strnchrp + 1, eof - p - 1, ':'; ... If the firmware image...

AZL-92739 CVE-2026-63959 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm/tcpcimaxim: validate header NDO against RXBYTECNT A broken/malicious port can transmit a CRC-valid frame whose header advertises up to seven data objects but whose body carries fewer than that. Check for this, an...

AZL-92757 CVE-2026-63954 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfsmapdnodebitmap fails If hpfsmapdnodebitmap fails, the code would call hpfsbrelse4 on uninitialized quad buffer head, causing a crash...

AZL-92778 CVE-2026-63960 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

AZL-92766 CVE-2026-63940 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' or count '0', so that setting up the software scratch area and other code doesn't have to worry about underflowing the length, and...

AZL-92781 CVE-2026-63881 affecting package kernel for versions less than 6.6.143-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger getqueueids computes arraysize = numqueues sizeofuint32t, which could overflow on 32-bit sizet build. using arraysize instead, it saturates to SIZEMAX on overflo...

AZL-92799 CVE-2026-63882 affecting package kernel for versions less than 6.6.143-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix NULL pointer bug in svmrangesetattr The processinfo could be NULL if user doesn't call kfdioctlacquirevm before calling kfdioctlsvm. cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4...

AZL-92790 CVE-2026-63879 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpuhmmrangegetpages The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the comm...

AZL-92570 CVE-2026-63871 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

AZL-92522 CVE-2026-63853 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: set nouserfence for VCN v4.0 enc ring VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit fd852c048b46f9825e904a4f3f4538fe9d8827...

AZL-92582 CVE-2026-63858 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

AZL-92567 CVE-2026-63833 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into iuid, igid and imode from ntfsgetwslperm. Because the empty-prefi...

AZL-92588 CVE-2026-63829 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

AZL-92516 CVE-2026-63825 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflatefast, the inner copy loops get transformed ...

AZL-92579 CVE-2026-63826 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: fbdev: fix use-after-free in storemodes storemodes replaces a framebuffer's modelist with modes from userspace. On success it frees the old modelist with fbdestroymodelist. Two fields still point into that freed list. One pointer...