CVE-2026-52836 OpenDDS: out-of-bounds `rd_ptr` dereference in `RtpsSampleHeader::init` — triggered by malformed RTPS submessage, remotely exploitable denial of service

OpenDDS is an open source C++ implementation of the Object Management Group OMG Data Distribution Service DDS. Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes...

SUSE CVE-2026-89591

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: initialize job domain before cleanup paths rocketioctlsubmitjob releases rjob through rocketjobput on allocation error paths. rocketjobcleanup unconditionally calls rocketiommudomainputjob-domain, but job-domain is...

SUSE CVE-2026-89802

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix NULL deref unwinding an OPMAPSPARSE op Each bindjobop is zeroed by kzallocobj in bindjobopfromuop, and the OPMAPSPARSE case in nouveauuvmmbindjobsubmit only creates a region, so op-ops stays NULL for a...

SUSE CVE-2026-89807

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restoremqd in CRIU queue restore Both createqueuecpsch and createqueuenocpsch unconditionally call mqdmgr-restoremqd when a CRIU restore is in progress qd != NULL, with no NULL guard. On any system...

SUSE CVE-2026-89809

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix scope of mqdmgr dereference in pqmdebugfsmqds Reading /sys/kernel/debug/kfd/mqds while a process holds an active KFD queue triggers a NULL pointer dereference because the for loop that calls mqdmgr-debugfsshowmqd ...

SUSE CVE-2026-89835

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpointmerge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fsissueckpt there, but ckptthreadioprio is...

SUSE CVE-2026-89845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid reqqmap double-read in qla2x00errorentry qla2x00errorentry reads ha-reqqmapque twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xxfreereqque ha-reqqmapqueid =...

SUSE CVE-2026-89849

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path qla2x00statusentry filters out non-TYPESRB entries and the SRBNVMECMD, SRBBIDICMD and SRBTMCMD types, then falls through to a SCSI fast path that assumes the command is ...

SUSE CVE-2026-89863

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check qlachkedifrxsadeletepending obtains the SCSI command via GETCMDSPsp and immediately dereferences cmd-scdatadirection. That command pointer can be NULL: the firmwar...

SUSE CVE-2026-89874

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-async: avoid deleting unlinked ASC entry on link error v4l2asyncmatchnotify creates ancillary media links before adding asc-ascsubdeventry to sd-asclist. If ancillary link creation fails, the function jumps to...

SUSE CVE-2026-89884

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup Add the missing sanity check after looking up the SCP to avoid dereferencing a NULL-pointer in case its driver has not yet been bound...

SUSE CVE-2026-89901

In the Linux kernel, the following vulnerability has been resolved: media: airspy: use vb2videounregisterdevice on disconnect to fix NULL deref airspydisconnect clears s-udev under v4l2lock, but airspystopstreaming unconditionally calls airspyctrlmsg and airspyfreestreambufs afterwards. If a...

SUSE CVE-2026-89912

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save MAPC with V=0 drops ite-collection but leaves the ITE on the device's ITT list, and vgicitssaveite dereferences it unconditionally. A guest that issues MAPD,...

SUSE CVE-2026-89958

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: Fix dereference matrixmdev-kvm without checking for NULL The apdriver structure has two fields which are function pointers to callbacks: .onconfigchanged: called at the start of the AP bus scan function to notify th...

SUSE CVE-2026-89966

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlbcma: fix null nodemask dereference in hugetlbcmaallocfrozenfolio allocbuddyhugetlbfoliowithmpol can pass a NULL nodemask to allocfreshhugetlbfolio as a fallback to allocate from all nodes. If order is gigantic,...

SUSE CVE-2026-89977

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: check MMIO mapping errors in probe devmplatformioremapresource returns an error pointer when the register resource cannot be mapped. ethosuprobe stores it and continues until initialization dereferences it through...

SUSE CVE-2026-89993

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: Initialize IRQ data before requesting IRQs dwedmairqrequest passes struct dwedmairq to requestirq before dwedmachannelsetup fills the back pointer. A shared interrupt can therefore enter the handler with...

SUSE CVE-2026-89994

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: tracing: no ptr dereference during log output The fsl edma events store a pointer to a struct fsledmaengine in the ringbuffer and dereference it when a log entry is printed. At this time, the pointer may no...

SUSE CVE-2026-90004

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: handle region split failure in applyminnrregions damonapplyminnrregions repeatedly split each region until its size becomes small enough to meet the user-defined low limit of the number of regions. The loop assumes...

SUSE CVE-2026-90012

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, spimapmsg unmaps TX but leaves txsgmapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers...