{"id":"AZL-111233","summary":"CVE-2026-99126 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/ctcm: Prevent XID null dereference\n\nThe mpc_validate_xid() function sets grp-\u003esaved_xid2-\u003exid2_flag2 to 0x40\nto signal XID validation error. If peer XID is NULL or r/w channel\npairing mismatch happens, grp-\u003esaved_xid2 is never initialized. An\nattempt to set the flag in such case leads to NULL dereference.\n\nFix this by using the always available priv-\u003exid-\u003exid2_flag2 instead of\ngrp-\u003esaved_xid2-\u003exid2_flag2 for validation errors.","modified":"2026-10-30T05:35:37Z","published":"2026-10-28T11:17:32Z","upstream":["CVE-2026-99126"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99126"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111233.json"}}],"schema_version":"1.9.2"}