CVE-2026-64332

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

EUVD-2026-48876

In the Linux kernel, the following vulnerability has been resolved: USB: ulpi: fix memory leak on registration failure The allocated device name is never freed on early ULPI device registration failures. Fix this by initialising the device structure earlier and releasing the initial reference...

CVE-2026-64317 isofs: bound Rock Ridge symlink components to the SL record

In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling in parserockridgeinodeinternal walk the variable-length components of a Rock Ridge "SL" symbolic link record. Each component is a...

CVE-2026-64306 crypto: drbg - Fix returning success on failure in CTR_DRBG

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64307

Summary: CVE-2026-64307 relates to the Linux kernel crypto/ccp path, where SNP initialization for ioctl SNP_CONFIG is now not performed. The public descriptions describe an ABI-change and a fix in the SNP initialization path, with discussion about preventing re-init after a failed SNP init, and p...

CVE-2026-64307 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64307 crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303 spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64303

In CVE-2026-64303, a Linux kernel vulnerability in the fsl-lpspi driver occurs when dmaengine_prep_slave_sg() fails for the TX channel: the TX path is terminated but the RX path (already submitted) continues, unmapping buffers on -EINVAL and risking memory corruption or use-after-free. The fixed ...

EUVD-2026-49009

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

Summary (CVE-2026-64297): The Linux kernel vuln arises from not checking the return value of module_extend_max_pages() inside the decompression path. When initial allocation fails, info->pages is NULL and info->max_pages is 0. Subsequent calls to module_get_next_page() may call module_exten...

CVE-2026-64279

CVE-2026-64279 concerns the Linux kernel i2c core: a race in adapter deregistration where an adapter may be accessed after resources are freed. The fix removes the adapter from the IDR before tearing it down during deregistration or on registration failure to prevent use-after-free of resources s...

CVE-2026-64279 i2c: core: fix adapter deregistration race

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2cgetadapter which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64258 fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

...

SUSE CVE-2026-64222

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...

SUSE CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...