SUSE CVE-2026-98437

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pmruntimeresumeandget in irisenablepowerdomains to avoid leaking a runtime PM usage count on failure. Also ensure pmruntimeputsync is always called in irisdisablepowerdomains,...

SUSE CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

SUSE CVE-2026-98439

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

SUSE CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

SUSE CVE-2026-98441

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

SUSE CVE-2026-98442

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

SUSE CVE-2026-98443

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

SUSE CVE-2026-98444

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

SUSE CVE-2026-98446

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

SUSE CVE-2026-98447

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

SUSE CVE-2026-98448

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

SUSE CVE-2026-98450

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

SUSE CVE-2026-98452

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

SUSE CVE-2026-98453

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

SUSE CVE-2026-98454

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...

SUSE CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

SUSE CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

SUSE CVE-2026-98458

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

SUSE CVE-2026-98459

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

SUSE CVE-2026-98460

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...