SUSE CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...

SUSE CVE-2026-98772

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

SUSE CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

SUSE CVE-2026-98777

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

SUSE CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

SUSE CVE-2026-98780

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

SUSE CVE-2026-98781

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

SUSE CVE-2026-98783

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

SUSE CVE-2026-98789

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

SUSE CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

SUSE CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

SUSE CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

SUSE CVE-2026-98839

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

SUSE CVE-2026-98860

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

SUSE CVE-2026-98861

In the Linux kernel, the following vulnerability has been resolved: fprobe: Use guardrcuschednotrace and check rcuiswatching unregisterfprobe and unregisterfprobeasync used by BPF kprobe-multi rely on standard RCU grace periods synchronizercu and callrcu to wait until in-flight fprobe handlers...

SUSE CVE-2026-98864

In the Linux kernel, the following vulnerability has been resolved: schedext: Wait for SCXOPSSDISPATCHING before reenqueueing a task ebf1ccff79c4 "schedext: Fix ops.dequeue semantics" moved the final opsstate store in scxdispatchenqueue after the DSQ unlock so that the custody update and...

SUSE CVE-2026-98866

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Introduce taskstruct-schedcachegrp to fix UAF Add a schedcachegrp pointer to taskstruct so that scheduler code can access the cache group directly via the task, without going through mm-schedcachegrp. This decouples...

SUSE CVE-2026-98867

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

kernel: USB: serial: cypress_m8: fix memory corruption with small endpoint

A flaw was found in the Linux kernel's cypressm8 USB serial driver. A malicious Universal Serial Bus USB device could report a packet size smaller than eight bytes for the interrupt-out endpoint. This can lead to memory corruption, specifically user-controlled slab corruption or a NULL-pointer...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...