AZL-106035 CVE-2026-98369 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

AZL-106164 CVE-2026-98366 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

AZL-106296 CVE-2026-98364 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

AZL-106212 CVE-2026-98363 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

AZL-106176 CVE-2026-98367 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

AZL-106020 CVE-2026-98362 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

AZL-106473 CVE-2026-98365 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

AZL-106395 CVE-2026-98359 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

AZL-106113 CVE-2026-98360 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

AZL-106209 CVE-2026-98355 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

AZL-106140 CVE-2026-98358 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

AZL-106439 CVE-2026-98357 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then...

AZL-106194 CVE-2026-98353 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...

AZL-106302 CVE-2026-98349 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

AZL-106188 CVE-2026-98351 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

AZL-106290 CVE-2026-98354 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

AZL-106173 CVE-2026-98352 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget, before the peer is connected. createcm can return -ERESTARTSYS from...

AZL-106005 CVE-2026-98342 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

AZL-106095 CVE-2026-98343 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

AZL-106251 CVE-2026-98344 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

AZL-106086 CVE-2026-98348 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

AZL-105990 CVE-2026-98345 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

AZL-106446 CVE-2026-98347 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

AZL-106179 CVE-2026-98340 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

AZL-106125 CVE-2026-98337 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

AZL-106065 CVE-2026-98335 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

AZL-106230 CVE-2026-98341 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't free driver-owned scan requests When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it own...

AZL-106257 CVE-2026-98338 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with...

AZL-106101 CVE-2026-98339 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211updateassocbssentry removes that entry before rehashing the real one, since the two...

AZL-106317 CVE-2026-98336 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't offload TC setup on APVLAN interfaces APVLAN interfaces are purely virtual, so don't try to offload TC setup to drivers. We can't really use the AP interface either since we may not know it all the time, and...

AZL-106098 CVE-2026-98333 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the LED state when ifup fails When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running. But if bringing up the interface fails then the tim...

AZL-106068 CVE-2026-98330 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: get the wiphy out of a dying network namespace When a network namespace is destroyed, cfg80211pernetexit moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fai...

AZL-106077 CVE-2026-98334 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap can set enablebeacon and beaconint and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops:...

AZL-106434 CVE-2026-98328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

AZL-106415 CVE-2026-98329 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual...

AZL-106347 CVE-2026-98331 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211ifremove, before it unregisters the netdev. However, it's possible...

AZL-106254 CVE-2026-98332 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211tdlsoper can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused...

AZL-106458 CVE-2026-98323 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

AZL-106365 CVE-2026-98321 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

AZL-106425 CVE-2026-98326 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

AZL-106158 CVE-2026-98322 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

AZL-105993 CVE-2026-98325 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

AZL-106248 CVE-2026-98327 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

AZL-106398 CVE-2026-98319 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

AZL-106332 CVE-2026-98317 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

AZL-106470 CVE-2026-98316 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

AZL-106083 CVE-2026-98320 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

AZL-106380 CVE-2026-98314 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

AZL-106062 CVE-2026-98309 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

AZL-106443 CVE-2026-98311 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...