SUSE CVE-2026-64481

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

SUSE CVE-2026-64511

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 "ACPI: NFIT: Install Notify handler before getting NFIT table", acpinfitprobe installs an ACPI notify handler for the NFIT device before checking t...

SUSE CVE-2026-64516

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access...

SUSE CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

CVE-2026-64516

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access...

CVE-2026-64481

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

CVE-2026-64376

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64275

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - prevent division by zero and arithmetic underflow The Elan I2C touchpad driver queries the device for its physical dimensions and trace counts to calculate the device resolution and width. However, if the device...

CVE-2026-64481

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

UBUNTU-CVE-2026-64376

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

UBUNTU-CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

UBUNTU-CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64376

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

UBUNTU-CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

UBUNTU-CVE-2026-64481

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

CVE-2026-64407

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxprecvfwreqv3 During the v3 firmware download the controller sends a v3datareq with a 32 bit offset and a 16 bit len. nxprecvfwreqv3 checks only the lower bound of the...

UBUNTU-CVE-2026-64511

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible NULL pointer dereference After commit 9b311b7313d6 "ACPI: NFIT: Install Notify handler before getting NFIT table", acpinfitprobe installs an ACPI notify handler for the NFIT device before checking t...