CVE-2026-93433

A stack buffer overflow in libstoragemgmt's _sg_parse_vpd_80() function allows a local or virtual storage device controlled by an attacker to supply malformed SCSI VPD page 0x80 data with an untrusted page length field. This can crash or destabilize the process querying the serial number, resulti...

EUVD-2026-84117

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack...

kernel: Fix of 56 CVEs

usb: free iso schedules on failed submit CVE-2026-64348 - udf: validate VAT header length against the VAT inode size CVE-2026-64323 - USB: idmouse: fix use-after-free on disconnect race CVE-2026-64344 - USB: ldusb: fix use-after-free on disconnect race CVE-2026-64343 - USB: iowarrior: fix...

CVE-2026-93433: Stack-based Buffer Overflow

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack...

PT-2026-96244

Name of the Vulnerable Software and Affected Versions libstoragemgmt affected versions not specified Description A flaw exists where an attacker controlling a local or virtual storage device can provide specially crafted SCSI Small Computer System Interface Vital Product Data VPD page 0x80 data. ...

SUSE CVE-2026-89856

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation ha-msixcount is u16, but ha-maxreqqueues, ha-maxrspqueues and ha-maxqpairs are u8. Deriving the queue count as "ha-maxreqqueues = ha-msixcount - 1" therefore...

SUSE CVE-2026-90009

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in iouring passthrough command setup scsibsguringcmd reads bsguringcmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. requestlen is the sharp case: it can gr...

SUSE CVE-2026-90010

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap iouring sense copy to maxresponselen Completion copied scmd-senselen to the user response buffer without honoring maxresponselen. After a valid sense, the midlayer sets senselen to the real length up to...

SUSE CVE-2026-90202

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

SUSE CVE-2026-90268

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

SUSE CVE-2026-90285

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

SUSE CVE-2026-90293

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

SUSE CVE-2026-92478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX equalization code to index arrays sized by UFSMAXLANES. Reject zero and out-of-range RX or TX lane counts before they can be propagated...

SUSE CVE-2026-92480

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate string descriptors The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16stoutf8s expects a count of UTF-16 code units, not bytes. Passing the payload byt...

Linux Distros Unpatched Vulnerability : CVE-2026-92478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Validate connected lane counts The connected lane count is used by TX...

Linux Distros Unpatched Vulnerability : CVE-2026-90268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskd...

Linux Distros Unpatched Vulnerability : CVE-2026-90267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If...

DEBIAN-CVE-2026-92479

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Avoid NULL CQE dereference when reporting invalid tags The single-doorbell completion path can call ufshcdcomplonecqe with a NULL CQE. If no command is associated with the completion tag, the warning message dereferenc...

CVE-2026-90293

In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registration isertputlogintx posts the full-feature receive buffers before transportregistersession runs, so an initiator that does not wait for the final Login Respon...

AZL-102977 CVE-2026-90267 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...