SUSE CVE-2026-93813

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

SUSE CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

AZL-104799 CVE-2026-98155 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

DEBIAN-CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

AZL-104685 CVE-2026-98158 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

CVE-2026-98158

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

DEBIAN-CVE-2026-98158

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

DEBIAN-CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

DEBIAN-CVE-2026-98062

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

CVE-2026-98062

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

AZL-104697 CVE-2026-98007 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-97941

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

CVE-2026-97942

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

CVE-2026-97944

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

AZL-104768 CVE-2026-97934 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

CVE-2026-97934

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

DEBIAN-CVE-2026-97934

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

DEBIAN-CVE-2026-97537

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...