AZL-103494 CVE-2026-93599 affecting package rust 1.75.0-31

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

AZL-103506 CVE-2026-93599 affecting package rust 1.96.1-2

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

AZL-103463 CVE-2026-93602 affecting package kata-containers-cc 3.15.0.aks0-21

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

AZL-103466 CVE-2026-93600 affecting package kata-containers-cc 3.15.0.aks0-21

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

AZL-103511 CVE-2026-93602 affecting package rust 1.96.1-2

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

AZL-103503 CVE-2026-93602 affecting package rust 1.75.0-31

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

AZL-103460 CVE-2026-93601 affecting package kata-containers-cc 3.15.0.aks0-21

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-103500 CVE-2026-93601 affecting package rust 1.75.0-31

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-103527 CVE-2026-93600 affecting package rust-afterburn 5.8.2-2

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

AZL-103521 CVE-2026-93601 affecting package rust-afterburn 5.8.2-2

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-103509 CVE-2026-93601 affecting package rust 1.96.1-2

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

AZL-105275 CVE-2026-81627 affecting package qemu 10.1.0-1

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

AZL-103377 CVE-2026-93450 affecting package kubevirt 1.8.4-2

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing...

AZL-105087 CVE-2026-44236 affecting package librabbitmq 0.14.0-1

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.framemax value during amqplogin, and rabbitmq-c accepts the value in amqplogininner in librabbitmq/amqpsocket.c. amqptuneconnection in...

AZL-105084 CVE-2026-44235 affecting package librabbitmq 0.14.0-1

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned sizet underflow in amqphandleinput in librabbitmq/amqpconnection.c. The parser subtracts HEADERSIZE, fixed...

AZL-101906 CVE-2026-93202 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix recursive locking during device registration i3cmasterregisternewi3cdevs registers newly discovered devices while holding i3cbusnormaluselock, a downread. deviceregister can immediately probe the device, and prob...

AZL-102401 CVE-2026-93199 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Do not treat master device as a duplicate target i3cmastersearchi3cdevduplicate searches the bus for another I3C device with the same PID as the reference device. The search can match master-this, causing the...

AZL-102198 CVE-2026-93200 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix use-after-free of master-this sysfs attribute callbacks for the master controller device dereference master-this. However, master-this is freed in i3cmasterdetachfreedevs before the master device itself is...

AZL-102131 CVE-2026-93203 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid CRC corruption due to parallel claim add batadvblaaddclaim is used to add claims and modify the backbone of claims for CLAIM frames from remote backbones and local packets. When it handles a claim, it needs...

AZL-103035 CVE-2026-93204 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In worst case, the reader is...

AZL-102605 CVE-2026-93196 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvdimm: virtiopmem: refcount requests for token lifetime KASAN reports slab-use-after-free in wakeupcommon: BUG: KASAN: slab-use-after-free in wakeupcommon+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0...

AZL-103013 CVE-2026-93189 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: core: quiesce input in hidhwstop to prevent use-after-free A driver's probe calls hiddeviceiostart to enable input delivery, then fails at a later initialization step and unwinds via hidhwstop. The unwind frees struct hidraw...

AZL-102830 CVE-2026-93192 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Clear queue-activejob when v3dfencecreate fails The runjob callbacks for BIN, RENDER, TFU and CSD assign the incoming job to queue-activejob before calling v3dfencecreate. If v3dfencecreate fails, the callback returns NU...

AZL-102807 CVE-2026-93191 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smackmsgqueuemsgrcv The smackmsgqueuemsgrcv function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd syscall path, if a receiver is already...

AZL-102801 CVE-2026-93184 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslaudmix: rework runtime PM handling in probe After pmruntimeenable the AUDMIX block is powered off and stays suspended until the first runtime resume. Register writes issued between probe and the first resume e.g. from DA...

AZL-102953 CVE-2026-93186 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl/mbox: Clamp mailbox output allocation to the payload size CXLMEMSENDCOMMAND bounds the user's in.size to the mailbox payload size but leaves out.size unbounded, then cxlmboxcmdctor calls kvzallocout.size. A large out.size...

AZL-102719 CVE-2026-93183 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/lima: call drmmminit with a valid allocation range limavmcreate is currently run before vastart and vaend are set up, meaning they are both 0. limavmcreate runs drmmminit with them as arguments for the allocator, and if...

AZL-102762 CVE-2026-93188 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: bound device-supplied profile index konekeepvaluesuptodate and koneprofileactivated use an 8-bit, device-supplied profile value as an index into the 5-element kone-profiles array without a range check. A malicious US...

AZL-102152 CVE-2026-93185 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: rt700-sdw: always drain jack work on remove rt700sdwremove drains jackdetectwork and jackbtncheckwork only when rt700-hwinit is true. That state bit is cleared by rt700updatestatus when the SoundWire slave becomes UNATTACHE...

AZL-102744 CVE-2026-93182 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

AZL-102309 CVE-2026-93175 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpudmcrtcresetstate frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangling...

AZL-102836 CVE-2026-93176 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpudmplanedrmplanereset frees the old state before allocating a new one. If kzalloc fails, the function returns without updating the state pointer, leaving a dangli...

AZL-102455 CVE-2026-93174 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

AZL-102249 CVE-2026-93179 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read wh...

AZL-102029 CVE-2026-93178 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

AZL-102294 CVE-2026-93177 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL wh...

AZL-102893 CVE-2026-93172 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: handle allocpercpu failure in freeareainitcorehotplug We miss a failed allocation check for pgdat-percpunodestats, which results in a NULL deref when we offset into the per-cpu area. Propagate -ENOMEM up the stack and...

AZL-102399 CVE-2026-93168 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix CPU stall in xilinxdmapolltimeout Currently when calling xilinxdmapolltimeout with delayus=0 and a condition that is never fulfilled, the CPU busy-waits for prolonged time and the timeout triggers only...

AZL-102876 CVE-2026-93167 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: csky: Fix a4/a5 restoration in syscall trace path The syscall trace path reloads syscall arguments from ptregs before calling the syscall handler. On C-SKY ABIv2, the 5th and 6th syscall arguments are prepared as stack arguments...

AZL-103028 CVE-2026-93170 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinxdma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers Fix a race condition in AXIDMA and MCDMA irq handlers where the channel could be incorrectly marked as idle and attempt spurious...

AZL-102882 CVE-2026-93163 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - fix rng list on registration error hwrngregisterrng does the following: 1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to...

AZL-102192 CVE-2026-93160 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

AZL-102084 CVE-2026-93161 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qatalgxtsreversekey expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary cryptoaesctx with...

AZL-102162 CVE-2026-93158 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: sa2ul - stop probe if context pool creation fails saulprobe calls sainitmem to create the DMA pool used for security context buffers, but ignores its return value. If pool creation fails, probe still continues with DMA...

AZL-102479 CVE-2026-93159 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a workdata structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng-priv and later...

AZL-101855 CVE-2026-93150 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

AZL-102314 CVE-2026-93155 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

AZL-103007 CVE-2026-93156 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rkhashrun waits for RKCRYPTOHASHSTS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads...

AZL-102752 CVE-2026-93154 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

AZL-102116 CVE-2026-93151 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...