CVE-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

DEBIAN-CVE-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

DEBIAN-CVE-2026-90088

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

DEBIAN-CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

DEBIAN-CVE-2026-90051

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

SUSE CVE-2026-89819

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes, the per-plane degamma LUT size was never validated before use. setdmplanedegamma...

SUSE CVE-2026-89821

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid divide-by-zero in islutlinear islutlinear computes the expected value of each entry with expected = i MAXDRMLUTVALUE / size - 1; If it is ever called with a single-entry LUT, size - 1 is zero and the kernel...

SUSE CVE-2026-90035

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix division by zero in getestimatedbw getestimatedbw divides by link-dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled...

SUSE CVE-2026-91955

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in...

CVE-2026-92881

A security vulnerability has been detected in vgmstream. The affected element is the function initvgmstreamawbmemory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is...

CVE-2026-93187 ASoC: SOF: ipc4-topology: Return error for invalid number of formats

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Return error for invalid number of formats When the number of input or output formats is zero, sofipc4widgetsetupcompsrc and sofipc4widgetsetupcompasrc print an error and jump to the cleanup label. At th...

CVE-2026-93182

CVE-2026-93182 is a u32 overflow in the Linux kernel's CFS scheduler (sched/fair), specifically in update_tg_cfs_runnable(). The overflow occurs when se->avg.runnable_avg * divider exceeds the 32-bit range, corrupting the runnable sum and cascading through load-average propagation to produce a...

CVE-2026-93182 sched/fair: Fix overflow in update_tg_cfs_runnable()

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

EUVD-2026-82290

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

CVE-2026-93182 sched/fair: Fix overflow in update_tg_cfs_runnable()

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix overflow in updatetgcfsrunnable A divide-by-zero crash is observed when running hackbench: 14697.488452 CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted 7.1.0-rc2+ 14697.492627 RIP:...

CVE-2026-93062 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93062 wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

EUVD-2026-82172

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

CVE-2026-93062

CVE-2026-93062 affects the Linux kernel in the iwlwifi wireless driver. The vulnerability is a division by zero in the function iwl_dbg_tlv_alloc_fragments, which can occur when num_frags evaluates to zero. The fix introduces a check that the required size is non-zero and adds a guard on num_frag...