SUSE CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

SUSE CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

SUSE CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

SUSE CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

SUSE CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

SUSE CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

SUSE CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

SUSE CVE-2026-98854

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

DEBIAN-CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

DEBIAN-CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

DEBIAN-CVE-2026-98849

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

DEBIAN-CVE-2026-98580

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

DEBIAN-CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

DEBIAN-CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

DEBIAN-CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

DEBIAN-CVE-2026-98504

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

DEBIAN-CVE-2026-98593

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

DEBIAN-CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

DEBIAN-CVE-2026-98651

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

DEBIAN-CVE-2026-98618

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...