SUSE CVE-2026-64039

In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code where most of the regions are aligned, but fails for snapshotting of the DSI da...

SUSE CVE-2026-64081

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Validate framework notification message layout Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and...

SUSE CVE-2026-64088

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative ttbufflen batadvorignode::ttbufflen was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. I...

SUSE CVE-2026-64089

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative lastchangesetlen batadvpivtt::lastchangesetlen len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative...

SUSE CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16 bit big-endian, peer-controlled is smaller than the fixed DDP/RDMA...

SUSE CVE-2026-64114

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

SUSE CVE-2026-64124

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

SUSE CVE-2026-64126

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the fixed header size. The handler then uses cp-advdatalen and...

SUSE CVE-2026-64191

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxfer uses data-block0 as the transfer length. The existing check only clamps it to avoid overrunning the chip-words256 register array,...

CVE-2026-59844 Libssh: libssh: denial of service via oversized sftp read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-59844 Libssh: libssh: denial of service via oversized sftp read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests. Mitigation No workaround available...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the SFTP read process. An attacker can cause excessive memory allocation and exhaust system resources by sending repeated requests with arbitrarily large lengths. Remediation A fix was...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the GSSAPIKeyExchange process when a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation. An attacker can access small portions of server memory by...

USN-8576-1: Linux kernel (NVIDIA Tegra) vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8575-1: Linux kernel vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

CVE-2026-64114

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

CVE-2026-64191

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

CVE-2026-64102

A flaw was found in the Linux kernel's Soft-iWARP siw component for Remote Direct Memory Access RDMA. A remote attacker can send a specially crafted iWARP Fast Path Data Unit FPDU with a manipulated length field. This manipulation causes an integer underflow, leading to a use-after-free...