AZL-98072 CVE-2026-80691 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...

AZL-98084 CVE-2026-80692 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

AZL-98057 CVE-2026-80684 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

AZL-97845 CVE-2026-80576 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

AZL-97287 CVE-2026-74658 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

AZL-96770 CVE-2026-65959 affecting package vitess for versions less than 19.0.4-13

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

AZL-96069 CVE-2026-74460 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

AZL-96641 CVE-2026-56859 affecting package golang 1.25.12-1

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

AZL-96659 CVE-2026-56864 affecting package golang 1.25.12-1

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

AZL-95723 CVE-2026-14663 affecting package postgresql for versions less than 16.15-1

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

AZL-95943 CVE-2026-13622 affecting package kubevirt 1.8.4-2

A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc//root/ paths using net.Dial without symlink protection. These socket paths reside in qemu-owned directories...

AZL-95559 CVE-2026-73077 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

AZL-95601 CVE-2026-71217 affecting package iperf3 for versions less than 3.17.1-5

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

AZL-94838 CVE-2026-68401 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix out-of-bound writes in ffasetupandtransmit Sashiko locally reports multiple out-of-bound issues in ffasetupandtransmit: 1 Writing epmemaccess-reserved can write out of bounds for FFA versions 1.2 as...

AZL-94932 CVE-2026-68254 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

AZL-94476 CVE-2026-64581 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

AZL-94470 CVE-2026-64573 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

AZL-94404 CVE-2026-64562 affecting package kernel for versions less than 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR freenested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loadedvmcsclear, the vCPU might migrate before the pointer is cleare...

AZL-94181 CVE-2026-7260 affecting package php for versions less than 8.3.33-1

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

AZL-94071 CVE-2026-64544 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...

AZL-94019 CVE-2026-17574 affecting package hdf5 for versions less than 1.14.6-4

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read...

AZL-92937 CVE-2026-52863 affecting package unbound for versions less than 1.25.2-1

In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow copy of the view name in effect that could lead to memory corruption if the owner of the original view name is jostled out when Unbound is under pressure...

AZL-93072 CVE-2026-16560 affecting package 389-ds-base 3.1.1-12

A heap-buffer-overflow flaw was found in Directory Server 389-ds-base. When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation...

AZL-93222 CVE-2026-56852 affecting package kubernetes for versions less than 1.30.10-27

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-92778 CVE-2026-63960 affecting package kernel for versions less than 6.6.144.1-2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wcove: don't write past struct pdmessage in wcovereadrxbuffer wcovereadrxbuffer copies the PD RX FIFO into the caller's struct pdmessage with for i = 0; i regmap, USBCRXDATA + i, msg + i; which has two problems:...

AZL-92576 CVE-2026-53399 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When nfsd4layoutsetlease then fails, the error pat...

AZL-92343 CVE-2026-57213 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqfederationmanagement plugin renders the consumertag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute...

AZL-92346 CVE-2026-57218 affecting package rabbitmq-server for versions less than 3.13.7-8

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after...

AZL-92250 CVE-2026-58250 affecting package telegraf for versions less than 1.31.0-27

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by...

AZL-91791 CVE-2026-9079 affecting package curl for versions less than 8.11.1-10

libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them...

AZL-91062 CVE-2026-57438 affecting package rubygem-nokogiri for versions less than 1.19.4-1

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, XInclude substitution performed by Nokogiri::XML::Nodedoxinclude replaced each in place, freeing the include node along with its children such as and its descendants and any namespaces declared on...

AZL-90815 CVE-2026-52941 affecting package kernel for versions less than 6.6.143.1-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...

AZL-91206 CVE-2026-48931 affecting package nodejs for versions less than 24.17.0-1

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

AZL-91272 CVE-2026-3196 affecting package qemu for versions less than 9.1.0-10

An integer overflow vulnerability was found in the virtio-snd device via PCMINFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition...

AZL-89543 CVE-2026-50264 affecting package xorg-x11-server 1.20.10-6

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for...

AZL-89388 CVE-2026-50593 affecting package graphite2 1.3.14-3

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range...

AZL-88985 CVE-2026-46209 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drmgemfbinitwithfuncs drmgemfbinitwithfuncs computes sub-sampled plane dimensions using plain integer division: unsigned int width = modecmd-width / i ? info-hsub : 1;...

AZL-88920 CVE-2026-46119 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix slab-out-of-bounds access in auth message processing If a potentially corrupted message of type CEPHMSGAUTHREPLY contains a positive value in its result field, it is treated as an error code by cephhandleauthreply an...

AZL-89196 CVE-2026-9804 affecting package kubevirt for versions less than 1.8.4-1

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link symlink within an exported filesystem Persistent Volume Claim PVC that points...

AZL-88719 CVE-2026-46058 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: media: amphion: Fix race between m2m jobabort and devicerun Fix kernel panic caused by race condition where v4l2m2mctxrelease frees m2mctx while v4l2m2mtryrun is about to call devicerun with the same context. Race sequence:...

AZL-88715 CVE-2026-46054 affecting package kernel for versions less than 6.6.144.1-1

In the Linux kernel, the following vulnerability has been resolved: selinux: fix overlayfs mmap and mprotect access checks The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file the "user" file and the mounter's credentials ar...

AZL-88694 CVE-2026-46049 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Add fallback to default RSR for S/PDIF spdifpassthruplaybackgetresources uses atc-pllrate as the RSR for the MSR calculation loop. However, pllrate is only updated in atcpllinit and not in hwpllinit, so it remains 0...

AZL-88455 CVE-2026-46043 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payloadsize in rxercv rxercv currently checks only that the incoming packet is at least headersizepkt bytes long before payloadsize is used. However, payloadsize subtracts both the...

AZL-88574 CVE-2026-46023 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: dm mirror: fix integer overflow in createdirtylog The argument count calculation in createdirtylog performs argsused = 2 + paramcount before validating against argc. When a user provides a paramcount close to UINTMAX via the devi...

AZL-88556 CVE-2026-45858 affecting package kernel for versions less than 6.6.139.1-1

In the Linux kernel, the following vulnerability has been resolved: ext4: don't zero the entire extent if EXT4EXTDATAPARTIALVALID1 When allocating initialized blocks from a large unwritten extent, or when splitting an unwritten extent during end I/O and converting it to initialized, there is...

AZL-88236 CVE-2026-27136 affecting package prometheus-adapter for versions less than 0.12.0-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87753 CVE-2026-39821 affecting package gh for versions less than 2.62.0-16

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-88095 CVE-2026-39821 affecting package multus for versions less than 4.0.2-8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-88341 CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87768 CVE-2026-39835 affecting package gh for versions less than 2.62.0-17

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil...