AZL-102758 CVE-2026-90298 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds...

AZL-101996 CVE-2026-90293 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

AZL-103001 CVE-2026-90290 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...

AZL-101870 CVE-2026-90291 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

AZL-101852 CVE-2026-90294 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registered isertputlogintx puts the final Login Response on the wire before transportregistersession, which iscsipostloginhandler reaches only after iscsitargetdologin...

AZL-101888 CVE-2026-90292 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

AZL-102245 CVE-2026-90295 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imx6socvolt is allocated fresh on every probe, sized to the number of ARM OPPs: imx6socvolt = devmkcalloccpudev, num, sizeofimx6socvolt, GFPKERNEL; but it is fill...

AZL-102461 CVE-2026-90296 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6socvolt is allocated with devmkcalloccpudev, ..., where cpudev is the CPU device from getcpudevice0. That device is never unbound, so its devres list is never...

AZL-102428 CVE-2026-90287 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: sunplus: fix error handling in spuphyinit Fix the error paths of spuphyinit to undo exactly what each stage did: return directly if clkprepareenable fails, release only the clock if resetcontroldeassert fails, and jump to...

AZL-101918 CVE-2026-90289 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPUDMMAXDISPLAYINDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAXDISPLAYCOUNT. Hence we're off by one with DRM core, which...

AZL-102572 CVE-2026-90285 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

AZL-101912 CVE-2026-90284 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...

AZL-102119 CVE-2026-90286 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: Use PFP on the compute queues too On GFX6, the compute rings use the same CP path as the graphics ring. The only difference is that they don't support draw commands. As opposed to GFX7 and newer which have a...

AZL-102600 CVE-2026-90283 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fillsuper failure hugetlbfsfillsuper allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool may also reserve huge pages for minsize. If root dentry creation...

AZL-102852 CVE-2026-90282 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

AZL-102684 CVE-2026-90275 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

AZL-102824 CVE-2026-90279 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

AZL-102404 CVE-2026-90281 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Runtime PM must be enabled before creating the PHY, since phycreate only enables runtime PM on the PHY device if it is already enabled on this parent...

AZL-101939 CVE-2026-90280 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because runtim...

AZL-102977 CVE-2026-90267 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

AZL-102024 CVE-2026-90265 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and...

AZL-102999 CVE-2026-90273 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...

AZL-102915 CVE-2026-90274 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: fix underflow for usage of nrseqstate - 1 According to IHI006H Embedded Trace Macrocell Architecture Specification0, TRCSEQEVR is implemented only when TRCIDR5.NUMSEQSTATE is 0b100, in which case n ranges from 0...

AZL-102465 CVE-2026-90263 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

AZL-102251 CVE-2026-90257 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

AZL-102108 CVE-2026-90259 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...

AZL-102258 CVE-2026-90261 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: flush active metadata block group at btreewritepages start btreewritepages writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block gro...

AZL-102291 CVE-2026-90264 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: always wait for ordered extents to avoid OE races BUG Syzbot reported a bug that there can be conflicting OEs for the same range: BTRFS critical device loop4: panic in insertorderedextent:264: overlapping ordered extents,...

AZL-102441 CVE-2026-90262 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

AZL-102869 CVE-2026-90255 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

AZL-102347 CVE-2026-90250 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

AZL-101909 CVE-2026-90256 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

AZL-102702 CVE-2026-90249 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

AZL-102884 CVE-2026-90254 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

AZL-102335 CVE-2026-90253 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

AZL-102443 CVE-2026-90251 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

AZL-102864 CVE-2026-90247 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

AZL-102564 CVE-2026-90248 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...

AZL-102891 CVE-2026-90245 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

AZL-102395 CVE-2026-90234 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFS: Return a delegation the client fails to record When an NFS server grants a delegation in an OPEN reply, nfsinodesetdelegation records it on the client. However, three of its error flows return without sending DELEGRETURN. A...

AZL-102491 CVE-2026-90237 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

AZL-101885 CVE-2026-90235 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

AZL-102206 CVE-2026-90232 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

AZL-102626 CVE-2026-90230 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix heap out-of-bounds read in nvmetauthnegotiate nvmetexecuteauthsend allocates the DH-HMAC-CHAP message buffer with the host-supplied transfer length tl and hands it to nvmetauthnegotiate without passing tl along...

AZL-101963 CVE-2026-90227 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMITIO with nvmecmdallowed Unlike IOCMD / IO64CMD, NVMEIOCTLSUBMITIO never calls nvmecmdallowed. Unprivileged callers can thus issue I/O on a partition device or write through a read-only file descriptor. Pass...

AZL-102158 CVE-2026-90228 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynszns When a host issues an Identify command with CNS 05h I/O Command Set specific Identify Namespace and CSI 02h ZNS targeting a file-backed namespace,...

AZL-102093 CVE-2026-90226 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

AZL-102729 CVE-2026-90229 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

AZL-102015 CVE-2026-90225 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached pointer inside the locked region. llcpsockbind assigns and clears...

AZL-102585 CVE-2026-90218 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...