CVE-2026-68264 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...

CVE-2026-68252

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

CVE-2026-68190

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetwpsie rtwgetwpsie iterates over IE data from network frames without validating that the IE header and payload fit within the remaining buffer before reading them. Specifically: - iniecnt...

CVE-2026-68159 libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE decodepgtemp decodes an user-controlled length but only rejects values large enough to overflow the allocation; it does not bound it to CEPHPGMAXSIZE. The helper back...

CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68151

The CVE-2026-68151 entry concerns the Linux kernel FDPIC ELF binary format driver (binfmt_elf_fdpic). The flaw arises in how the program header scan handles PT_INTERP: the code may break out of the inner switch rather than the outer loop, causing binaries with more than one PT_INTERP to overwrite...

CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68150 fs/super: fix emergency thaw double-unlock of s_umount

In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of sumount dothawall iterates over all superblocks via iteratesupers with SUPERITEREXCL, which acquires sumount exclusively before calling the callback and releases it afterwards. Howeve...

EUVD-2026-55536

In the Linux kernel, the following vulnerability has been resolved: fs/super: fix emergency thaw double-unlock of sumount dothawall iterates over all superblocks via iteratesupers with SUPERITEREXCL, which acquires sumount exclusively before calling the callback and releases it afterwards. Howeve...

CVE-2026-68146

The CVE-2026-68146 entry documents a Linux kernel ftrace vulnerability where the trace_parser state (idx, cont, buffer) could race when multiple threads share an open trace file descriptor and perform concurrent writes or releases. The fix introduces a global mutex (parser_lock) to serialize all ...

CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access

In the Linux kernel, the following vulnerability has been resolved: ftrace: Add global mutex to serialize traceparser access In ftrace, the traceparser structure is allocated and initialized when a trace file is opened, and is subsequently used across write and release handlers to parse user inpu...

CVE-2026-68145 iomap: fix out-of-bounds bitmap_set() with zero-length range

In the Linux kernel, the following vulnerability has been resolved: iomap: fix out-of-bounds bitmapset with zero-length range ifssetrangedirty and ifssetrangeuptodate compute lastblk as off + len - 1 iblkbits. When off is 0 and len is 0, the unsigned subtraction underflows to SIZEMAX, producing a...

CVE-2026-72690 Attendize Attendize - Cross-Tenant Authorization Bypass

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/eventid/question/create endpoint. The postCreateEventQuestion method loads the...

CVE-2026-68131 rbd: Reset positive result codes to zero in object map update path

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

CVE-2026-68128 ice: reject out-of-range ptype in ice_parser_profile_init

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

EUVD-2026-55505

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

EUVD-2026-55266

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

CVE-2026-68085 Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: clear HCIUARTSENDING when writework is canceled HCIUARTSENDING bit in txstate means writework is pending and blocks queueing it again. Currently this bit is not cleared when canceling the work in hciuartclose,...

CVE-2026-68085

CVE-2026-68085 — Linux kernel (Bluetooth hci_uart) Root cause: when canceling a pending write_work in hci_uart_close(), the HCI_UART_SENDING flag is not cleared, causing future writes to be blocked when the device is reopened. The fix clears HCI_UART_SENDING on cancellation and makes tx_skb handl...

Security update for python-ujson

This update for python-ujson fixes the following issue: CVE-2026-44660: memory leak in ujson.dump on write failure can lead to DoS bsc1270301. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...