CVE-2026-98634

A flaw was found in the Linux kernel's SCSI ZBC Zoned Block Commands driver. This vulnerability can lead to a denial of service DoS when the system attempts to scan a storage device that reports an excessively large number of zones. Due to integer truncation and overflow during zone calculations,...

CVE-2026-98635

A flaw was found in the Linux kernel. An attacker who attaches a specially crafted storage device can cause a Denial of Service DoS or kernel memory corruption. When the kernel revalidates zoned block devices—storage media divided into independent physical regions—it fails to verify that the...

CVE-2026-90024

A flaw was found in the Linux kernel's USB MIDI 2.0 gadget function. When the MIDI 2.0 gadget is configured with a specific input block direction, an endpoint may not be properly initialized. During subsequent endpoint cleanup, an attempt to access this uninitialized endpoint can lead to a...

CVE-2026-89780

A flaw was found in the Qualcomm rmnet driver of the Linux kernel. An unprivileged local user can exploit this vulnerability by manipulating network namespaces and rmnet link configurations. This can lead to a null-pointer dereference when processing deaggregated frames, causing a kernel panic an...

CVE-2026-80846

A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This can lead to a system crash, resulting in a Denial of Service...

CVE-2026-80822

A flaw was found in the Linux kernel's mailbox: mchp-ipc-sbi component. This vulnerability arises from a missing null check for a memory allocation function. If the memory allocation fails, it can lead to an error condition, potentially causing a denial of service DoS where the system becomes...

CVE-2026-80819

A flaw was found in the Bluetooth RFCOMM Radio Frequency Communication subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect DISC message to a device with a deferred RFCOMM channel. This can lead to a null pointer dereference when the system attempts t...

CVE-2026-80817

A flaw was found in the Linux kernel's iommu/iommufd component. A local user could exploit a race condition during the processing of I/O address space IOAS areas. This vulnerability occurs when iommufdioaschangeprocess attempts to access an IOAS area before its pages are fully mapped, leading to ...

CVE-2026-80816

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA FireWire Control Protocol FCP driver. Incorrect handling of the Universal Serial Bus Request Block URB for the notification endpoint could lead to a system crash. This occurs because the fcpinitnotify function uses a...

CVE-2026-80813

A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmetexecuteidentifynslist function by issuing a specific Identify command CNS 07h. This vulnerability can lead to a kernel crash, resulting in a Denial of Service DoS for the...

CVE-2026-80771

A flaw was found in the Linux kernel's Nintendo Joy-Con driver. A local attacker could potentially trigger a null pointer dereference by sending a concurrent force-feedback FFRUMBLE command while the device is being registered. This could lead to a system crash, resulting in a Denial of Service D...

CVE-2026-80756

A flaw was found in the SELinux subsystem of the Linux kernel. A local attacker could trigger a null pointer dereference by attempting to load a policy when no old policy exists and the policy conversion fails. This issue, reachable through a write operation to /sys/fs/selinux/load, could lead to...

SUSE CVE-2026-98505

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

SUSE CVE-2026-98506

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

SUSE CVE-2026-98509

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

SUSE CVE-2026-98542

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

SUSE CVE-2026-98549

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

SUSE CVE-2026-98573

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

SUSE CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

SUSE CVE-2026-98594

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...