AZL-102425 CVE-2026-90365 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: cancel reset and rc work on device unregister Both drivers cancelled dumpwork on unregister but left resetwork and rcwork to be flushed only by destroyworkqueue in mt76freedevice, which runs after the hw is unregister...

AZL-102164 CVE-2026-90367 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: hold dev-mt76.mutex while disabling tx worker in SER mt7996macresetwork parked the tx worker and disabled the RX/TX NAPIs before taking dev-mt76.mutex. mt76workerdisable/enable are plain kthread park/unpark, n...

AZL-102984 CVE-2026-90364 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Unregister cpufreq notifier on init failure acpiprocessordriverinit registers the cpufreq policy notifier before registering the ACPI processor driver and setting up CPU hotplug state. If driverregister or...

AZL-102170 CVE-2026-90368 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unwind state on addinterface failure When mt76wcidalloc fails, mt7915addinterface returned without clearing the vifmask/omacmask bits it had already set, without removing the firmware dev info added earlier, a...

AZL-102003 CVE-2026-90361 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix leak in ath11kservicereadyextevent Currently, during ath11kservicereadyextevent processing, svcrdyext.macphycaps can be allocated during TLV parsing. This is a temporary allocation that is freed on the success...

AZL-102678 CVE-2026-90362 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Drop devpmoppsetrate0 devpmoppsetrate0 removes the vote specified in required-opps but does not actually park the clock, making it run without the necessary power backing. Drop the explicit call to it. Every call sit...

AZL-102201 CVE-2026-90359 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

AZL-101981 CVE-2026-90353 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix ext PHY use-after-free on register error path After mt7915registerextphy succeeded, a failure of the main PHY mt7915initdebugfs or mt7915coredumpregister unwound through freephy2, which called...

AZL-102173 CVE-2026-90354 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

AZL-102047 CVE-2026-90352 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

AZL-103011 CVE-2026-90357 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement The flow is added to dev-twtlist before sending the agreement to the firmware, but the error path leaves it linked while flowidmask is never set. The flow slot...

AZL-102236 CVE-2026-90360 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use systemfreezablewq for init complete work scheduledelayedwork uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires 30s after boot t...

AZL-102515 CVE-2026-90358 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

AZL-102779 CVE-2026-90345 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P action frame handling without device vif Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary...

AZL-101849 CVE-2026-90347 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: Keep 'origx0' in-sync with x0 on syscall entry Commit e057b9477232 "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates" attempted to resolve a long-standing issue with syscall entry tracing, where ...

AZL-102671 CVE-2026-90346 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: clean up color-change beacon data on errors nl80211colorchange calls nl80211parsebeacon for the beaconnext template, which can allocate params.beaconnext.mbssidies and .rnries. A parsing failure returned directly...

AZL-102615 CVE-2026-90348 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: snoc: use memcpyfromio for MSA ramdump On WCN3990/SNOC the MSA region is mapped with devmmemremapMEMREMAPWT. On arm64 such a mapping is not Normal-cacheable, so unaligned accesses to it are not permitted...

AZL-102818 CVE-2026-90335 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tty: skip cdevdel when no cdev is registered TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel, causing a...

AZL-102156 CVE-2026-90336 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uartregisterdriver failure uartregisterdriver leaves drv-state pointing to freed memory when ttyallocdriver fails. If ttyregisterdriver fails, drv-ttydriver also retains a pointer after its...

AZL-102414 CVE-2026-90337 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serialcoreaddoneport allocates uport-ttygroups after uartconfigureport, which may register the console. If the allocation fails, the driver unwinds the po...

AZL-101927 CVE-2026-90341 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmware: coreboot: Validate table bounds The existing coreboottablepopulate bounds checks limit individual entries to the mapped length. However, coreboottableprobe replaces the platform resource length with header and table siz...

AZL-102519 CVE-2026-90343 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: stop PMSR before P2P and NAN teardown PMSR request teardown must abort active measurements while the wirelessdev is still present in the driver. cfg80211leavelocked and cfg80211stoppd already do this before invoki...

AZL-102474 CVE-2026-90334 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdevadd failure ttycdevadd drops the cdev reference when cdevadd fails, but leaves driver-cdevsindex pointing to freed memory. ttyunregisterdevice later passes that stale pointer to cdevdel, causing ...

AZL-102267 CVE-2026-90330 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix FF device cleanup on init failure hidppffinit creates the input force-feedback device with inputffcreate, then allocates the HID++ FF private data, effect ID array, and workqueue. If any of those...

AZL-102681 CVE-2026-90333 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: replace forgeable discard filler with a keyed sector marker The discard-block check in dmintegrityrwtag treats a stored tag of all 0xf6 bytes DISCARDFILLER as proof a block was discarded and skips HMAC verification...

AZL-101969 CVE-2026-90329 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: synchronize input before cleaning up a failed probe hiddeviceiostart allows reports to run concurrently with probe. If the probe subsequently fails, hiddeviceprobe releases driver resources and clears hdev-driver without fir...

AZL-102906 CVE-2026-90322 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nmnodelocalstore handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode return 255,...

AZL-102530 CVE-2026-90321 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxat...

AZL-101900 CVE-2026-90324 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

AZL-102555 CVE-2026-90325 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: skip dying blkg in blkcgactivatepolicy When switching IO schedulers on a block device, blkcgactivatepolicy can race with concurrent blkcg deletion, leading to a use-after-free in rcuacceleratecbs. T1: T2: blkgdestroy...

AZL-102774 CVE-2026-90326 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix race between policy activation and blkg destruction When switching an IO scheduler on a block device, blkcgactivatepolicy allocates blkgpolicydata pd for all blkgs attached to the queue. However, blkcgactivatepoli...

AZL-102635 CVE-2026-90327 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

AZL-102203 CVE-2026-90328 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Reject short reads Steam Controller FEATURE reports encode the size of the message in the message itself. Previously we were trusting that the size reported matched the size we actually read, leading to a potential...

AZL-102483 CVE-2026-90313 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

AZL-103040 CVE-2026-90315 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check securitylockeddownLOCKDOWNPCIACCESS, leaving the legacyio and legacymem files unprotected when the...

AZL-102764 CVE-2026-90320 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2validatexattrblock checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xhcount and...

AZL-102039 CVE-2026-90314 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: remoteproc: fix OOB read via signed offset in rsctableforeachentry table-offseti is a u32 from firmware, but was stored into a signed int. A crafted offset like 0xFFFFFFF0 becomes -16, placing hdr 16 bytes before the table buffer...

AZL-102240 CVE-2026-90317 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

AZL-102665 CVE-2026-90316 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/omap: dsi: Do not copy isr table To be able to unregister stuff from isrs, the corresponding table was copied. Nobody seems to unregister stuff that way, so it does not help. But there are stack-allocated objects passed to...

AZL-101879 CVE-2026-90319 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

AZL-102612 CVE-2026-90318 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fat: release buffer head after rebuilding parent fatscanlogstart leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fatscan. fatrebuildparent uses the directory entry to rebuild the...

AZL-102026 CVE-2026-90308 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev-qpxa and then use or reference them outside the xarray lock. erdmadestroyqp can drop the destroy-path reference and...

AZL-102362 CVE-2026-90311 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: thermal: hwmon: Remove hwmon class device along with its parent The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type. That turns out to be...

AZL-101903 CVE-2026-90307 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

AZL-102878 CVE-2026-90309 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

AZL-102569 CVE-2026-90301 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...

AZL-101873 CVE-2026-90303 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ARM: 9485/1: mm: acquire mmap write lock around showpte for user faults When CONFIGDEBUGUSER=y, and cmdline "userdebug=31" is set, a user fault may trigger showpte without any lock. If another thread in the same process...

AZL-102008 CVE-2026-90300 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in bpfgettaskstack Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path...

AZL-102758 CVE-2026-90298 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds...

AZL-102332 CVE-2026-90297 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4icrtcinit returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind, checks the result wi...