CVE-2026-45879 power: supply: bq25980: Fix use-after-free in power_supply_changed()

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25980: Fix use-after-free in powersupplychanged Using the devm variant for requesting IRQ before the devm variant for allocating/registering the powersupply handle, means that the powersupply handle will be...

CVE-2026-45874 phy: freescale: imx8qm-hsio: fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: phy: freescale: imx8qm-hsio: fix NULL pointer dereference During the probe the refclkpad pointer is set to NULL if the 'fsl,refclk-pad-mode' property is not defined in the devicetree node. But in imxhsioconfigureclkpad this point...

CVE-2026-45874

CVE-2026-45874 affects the Linux kernel component under the phosphate path for Freescale IMX8QM HSIO. The issue arises when the devicetree provides no fsl,refclk-pad-mode; during probe, refclk_pad is set to NULL, and imx_hsio_configure_clk_pad() uses this pointer unconditionally, risking a NULL p...

CVE-2026-45873 netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetrbtree: check for partial overlaps in anonymous sets Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic...

CVE-2026-45873

CVE-2026-45873 concerns Linux kernel netfilter nft_set_rbtree. The issue arises from partial overlap detection for anonymous sets where adjacent intervals omit end elements, allowing overlaps such as A-B and A-C with C

CVE-2026-45870

CVE-2026-45870 affects the Linux kernel’s SUNRPC auth_gss path. The issue is memory leaks in XDR decoding error paths caused by gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() allocating buffers via gssx_dec_buffer()/kmemdup() and returning on error without freeing previously allocated mem...

CVE-2026-45864 fs/ntfs3: prevent infinite loops caused by the next valid being the same

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent infinite loops caused by the next valid being the same When processing valid within the range valid : pos, if valid cannot be retrieved correctly, for example, if the retrieved valid value is always the same, th...

CVE-2026-45862

The CVE-2026-45862 issue concerns the Linux kernel’s IOMMU VT-d PASID handling. A flaw in the cache flush order when writing a freshly allocated zero-initialized PASID table to a PASID directory entry creates a time window during which non-coherent IOMMU hardware could access RAM contents that ar...

CVE-2026-45857 scsi: csiostor: Fix dereference of null pointer rn

In the Linux kernel, the following vulnerability has been resolved: scsi: csiostor: Fix dereference of null pointer rn The error exit path when rn is NULL ends up deferencing the null pointer rn via the use of the macro CSIOINCSTATS. Fix this by adding a new error return path label after the use ...

CVE-2026-45850 ipvs: skip ipv6 extension headers for csum checks

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph-len already contains its offset, so use it to fix the problem...

CVE-2026-45849 net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: add missing lock protection in ocelotportxmitinj ocelotportxmitinj calls ocelotcaninject and ocelotportinjectframe without holding the injection group lock. Both functions contain lockdepassertheld for the...

CVE-2026-45847 net: remove WARN_ON_ONCE when accessing forward path array

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE when accessing forward path array Although unlikely, recent support for IPIP tunnels increases chances of reaching this WARNONONCE if userspace manages to build a sufficiently long forward path. Remove it...

CVE-2025-71306

CVE-2025-71306 is a Linux kernel vulnerability affecting the Integrity Measurement Architecture (IMA). The issue is a stack-out-of-bounds access in the function ima_appraise_measurement when processing bprm_creds for exec, traced to an incorrect offset calculation caused by using container_of on ...

UBUNTU-CVE-2026-45845

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTMDELQDISC, tapriograft is called with new == NULL and stores NULL into q-qdiscscl - 1. Subsequent RTMGETTCLASS dump operatio...

EUVD-2026-32171

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTMDELQDISC, tapriograft is called with new == NULL and stores NULL into q-qdiscscl - 1. Subsequent RTMGETTCLASS dump operatio...

CVE-2026-45845

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix NULL pointer dereference in class dump When a TAPRIO child qdisc is deleted via RTMDELQDISC, tapriograft is called with new == NULL and stores NULL into q-qdiscscl - 1. Subsequent RTMGETTCLASS dump operatio...

CVE-2026-45845

The CVE-2026-45845 issue affects the Linux kernel net/sched taprio code. When deleting a TAPRIO child qdisc via RTM_DELQDISC, taprio_graft() could store NULL in q->qdiscs[] and later RTM_GETTCLASS dump paths could dereference a NULL pointer during taprio_dump_class(), causing a kernel NULL poi...

CVE-2026-45843

CVE-2026-45843 affects the Linux kernel’s SLIP/VJ-compressed TCP header handling (slip and slhc_uncompress). The vulnerability stems from decode() and pull16() not enforcing bounds against the packet end, and decode() masking its return value to 0xFFFF, causing potential over-reads when a compres...

CVE-2026-45837 bpf: Fix use-after-free in arena_vm_close on fork

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arenavmclose on fork arenavmopen only bumps vml-mmapcount but never registers the child VMA in arena-vmalist. The vml-vma always points at the parent VMA, so after parent munmap the pointer dangles. If...

OPENSUSE-SU-2026:20816-1 Security update for alloy

This update for alloy fixes the following issues - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service bsc1262955. - CVE-2026-41602: github.com/apache/thrift: TFramedTransport frame size headers can lead to a uint32 integer...