SUSE CVE-2026-74568

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Fix race between LPI release and re-registration Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray. LPI structures are maintained in the VGIC LPI...

SUSE CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

SUSE CVE-2026-74572

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btreewritepages holds fsinfo-zonedmetaiolock across the whole writeback loop, including...

SUSE CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

SUSE CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

SUSE CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 GhostLock – Honor BVL-AN16 Exploit Research...

CVE-2026-74576

In the Linux kernel, the following vulnerability has been resolved: mm/slab: prevent unbounded recursion in free path with new kmalloc type Commit 280ea9c3154b "mm/slab: avoid allocating slabobjext array from its own slab" avoided recursive allocation of objexts from kmalloc caches of the same...

CVE-2026-74575

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Prevent XDomain delayed work use-after-free on disconnect tbxdphandlerequest runs on systemwq and queues xd-statework via queuedelayedwork in three request handlers: PROPERTIESCHANGEDREQUEST, UUIDREQUEST via...

CVE-2026-74577

In the Linux kernel, the following vulnerability has been resolved: net: mpls: initialize rtmtos in mplsgetroute mplsgetroute builds the RTMNEWROUTE reply to an RTMGETROUTE request by filling a struct rtmsg allocated from an skb whose data area is not zeroed allocskbNLMSGGOODSIZE, .... It sets...

CVE-2026-74574

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxdcdevopen The faileddevadd and faileddevname paths drop the file-device reference while wq-wqlock is still held. If putdevicefdev drops the last reference, idxdfiledevrelease...

CVE-2026-74572

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock between metadata writeback and transaction commit When writing out metadata extent buffers in a zoned filesystem, btreewritepages holds fsinfo-zonedmetaiolock across the whole writeback loop, including...

CVE-2026-74566

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

CVE-2026-74567

In the Linux kernel, the following vulnerability has been resolved: keys: fix out-of-bounds read in keyringgetkeychunk For description-level chunks keyringgetkeychunk advances the read pointer by level sizeoflong past the inline prefix but only bounds-checks the prefix, so a long enough key...

CVE-2026-74570

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfsrlrealloc and ntfsrlreallocnofail...

CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp siphelptcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74559

In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xskbuildskb Fix generic xmit path multi-buffer logic when packets are either too big count of descriptors exceed MAXSKBFRAGS or an invalid descriptor is included in fragmented packe...

CVE-2026-74560

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xskdropskb for AFXDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole...