SUSE-SU-2026:3649-1 Security update for python313

This update for python313 fixes the following issues: - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. - CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. - CVE-2026-0864: improper handling of...

Security update for python313

This update for python313 fixes the following issues: CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. CVE-2025-15367: control characters may allow the injection of additional commands bsc1257041. CVE-2026-0864: improper handling of...

CVE-2026-76040

A flaw was found in chromium-browser. This use-after-free vulnerability allows a remote attacker, through social engineering, to execute arbitrary code outside of the sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-58083

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

CVE-2026-74314

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability arises from improper handling of special fields during the recycling of map values, which can lead to unsafe destruction operations. Specifically, in tracing programs operating within a Non-Maskable...

CVE-2026-58083

FreeBSD 15.1 contains a use-after-free vulnerability in the kqueue kernel subsystem's copy-on-fork path. During fork(2), a timer-based knote could fire and be enqueued on the kqueue's active list before the copy completed. The copy routine failed to account for this, potentially enqueuing the kno...

EUVD-2026-62351

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

CVE-2026-58083 Use-after-free in kqueue copy-on-fork

While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition,...

CVE-2026-72492

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. This memory corruption vulnerability, known as a use-after-free, occurs when the system attempts to use memory after it has been released. A remote attacker could trigger this by performing a concurrent close operation during lease...

CVE-2026-49428

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49427

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...

CVE-2026-49422

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49428

In FreeBSD's posixshm module, open(2) with O_TRUNC and fspacectl(2) failed to verify whether operations are permitted on largepage objects, incorrectly freeing kernel memory. An unprivileged local user can read freed kernel memory and escalate privileges. Affected: all supported versions prior to...

CVE-2026-49428 posixshm: system calls can incorrectly free memory of largepage objects

Certain system calls, such open2 with the OTRUNC flag set, and fspacectl2, could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel...

CVE-2026-49427 posixshm: largepage shared memory objects not explicitly wired

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile2 transmitted such an object with the SFNOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to...

CVE-2026-49427

CVE-2026-49427 is a use-after-free vulnerability in FreeBSD's POSIX largepage shared memory objects (posixshm module). Pages in largepage objects were not explicitly wired, so when sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed underlying pages while existing mappings s...

CVE-2026-49422

The FreeBSD advisory (FreeBSD-SA-26:43.tcp) confirms the bug affects all supported FreeBSD versions and provides specific correction commit hashes for stable/15, releng/15.1, releng/15.0, stable/14, releng/14.4, and releng/14.3 branches, all dated 2026-06-30. Workarounds include not loading tcp_r...

EUVD-2026-62244

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...

CVE-2026-49422 Use-after-free in TCP RACK stack option handler

The RACK setsockopt2 handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace...