AZL-102623 CVE-2026-90219 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

AZL-102693 CVE-2026-90222 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

AZL-102059 CVE-2026-90224 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

AZL-102122 CVE-2026-90221 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

AZL-102746 CVE-2026-90223 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

AZL-102359 CVE-2026-90213 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix memory leak in error path of buildtree In the error path of buildtree, node instances can remain in the local linked list when the function returns. Whenever an invalid value is detected in the self ID sequenc...

AZL-102449 CVE-2026-90216 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubiinitattach rolls back module initialization failures by scanning ubidevices0..i-1, where i is the mtd= parameter index. That assumes the parameter index matches the UBI device...

AZL-102368 CVE-2026-90209 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ echo .../vmur/level $ rmmod vmur...

AZL-102305 CVE-2026-90214 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: fix streamdata leak on open error In xlnxformatterpcmopen, streamdata is allocated and adata-playstream or adata-capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep or...

AZL-102899 CVE-2026-90202 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

AZL-102374 CVE-2026-90203 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

AZL-102641 CVE-2026-90206 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...

AZL-102285 CVE-2026-90205 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index...

AZL-103020 CVE-2026-90208 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsungpwm: Switch to rawspinlockt type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPTRT is enabled on ARM, regular spinlock is converted to a sleeping lock mutex-based,...

AZL-102377 CVE-2026-90204 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read BUG A corrupted append-DIO dinode high byte at offset 0xa1 corrupted from 0 to 1 can carry an idioorphanedslot outside the mounted filesystem slot range and trigger a use-after-fr...

AZL-102687 CVE-2026-90207 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

AZL-102926 CVE-2026-90200 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

AZL-102036 CVE-2026-90194 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

AZL-102422 CVE-2026-90199 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

AZL-102272 CVE-2026-90196 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

AZL-102738 CVE-2026-90198 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in sndcarddofree A use-after-free was detected in sndcarddofree when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards,...

AZL-102242 CVE-2026-90188 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creation later fails, errdev destroys the default devices and calls...

AZL-102177 CVE-2026-90187 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

AZL-102345 CVE-2026-90190 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

AZL-103017 CVE-2026-90186 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

AZL-102141 CVE-2026-90189 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

AZL-101951 CVE-2026-90182 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay turns sufficiently large debt into an explicit block-cgroup delay with blkcgsetdelay, setting blkg-usedelay to -1 and incrementing blkcg-congestioncount. Cleari...

AZL-102269 CVE-2026-90180 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...

AZL-102494 CVE-2026-90183 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange scales down its peers, and a peer that reaches...

AZL-102582 CVE-2026-90185 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

AZL-102302 CVE-2026-90184 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

AZL-102468 CVE-2026-90174 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

AZL-102453 CVE-2026-90175 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

AZL-102714 CVE-2026-90176 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

AZL-102846 CVE-2026-90179 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode changehat The use of changehat when in complain mode can cause a deadlock when the hat doesn't exist and a new learning profile is created for the missing profile. This is because changehat...

AZL-102066 CVE-2026-90170 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

AZL-102810 CVE-2026-90168 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: retain connection for pending notify work Deferred CHANGENOTIFY work keeps an async message ID after the original request work is released. A durable handle can outlive its connection, so the connection teardown can destro...

AZL-102542 CVE-2026-90169 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...

AZL-102911 CVE-2026-90167 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pendingbreak wakes that waiter, but without serializing the...

AZL-103047 CVE-2026-90161 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced...

AZL-102935 CVE-2026-90160 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

AZL-102218 CVE-2026-90166 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbdipctreeconnectrequest See the procedure below: ksmbdtreeconnconnect ksmbdshareconfigget share-name = kstrdup // fail if !testshareconfigflagshare, KSMBDSHAREFLAGPIPE // false // do not check...

AZL-102770 CVE-2026-90162 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

AZL-102138 CVE-2026-90165 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbdstopdurablescavenger See the procedure below: ksmbdlaunchksmbddurablescavenger durablescavengerrunning = true serverconf.dhtask = kthreadrun // fail, dhtask is an ERRPTR...

AZL-102578 CVE-2026-90155 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...

AZL-102458 CVE-2026-90153 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...

AZL-102651 CVE-2026-90156 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...

AZL-102821 CVE-2026-90151 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

AZL-102012 CVE-2026-90158 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call consoleisregistered in nfcondevice Since 7c2af0f634f1 "tty: ttyio: use consolelistlock for list synchronization" showconsactive calls the .device method under the consolelistlock, but consoleisregistered...

AZL-102420 CVE-2026-90154 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...