SUSE CVE-2026-64333

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix write buffer corruption The digiwriteinbcommand is supposed to wait for the write urb to become available or return an error, but instead it updates the transfer buffer and tries to resubmit the u...

SUSE CVE-2026-64334

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix hard lockup on disconnect If submitting the OOB write urb fails persistently e.g if the device is being disconnected the driver would loop indefinitely with interrupts disabled. Check for urb...

SUSE CVE-2026-64335

In the Linux kernel, the following vulnerability has been resolved: USB: serial: digiacceleport: fix broken rx after throttle If the port is closed while throttled, the read urb is never resubmitted and the port will not receive any further data until the device is reconnected or the driver is...

SUSE CVE-2026-64336

In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...

SUSE CVE-2026-64340

In the Linux kernel, the following vulnerability has been resolved: USB: legousbtower: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 U...

SUSE CVE-2026-64341

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...

SUSE CVE-2026-64342

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect Submitted write URBs are not stopped on close and therefore need to be stopped unconditionally on disconnect to avoid use-after-free in the completion handler...

SUSE CVE-2026-64343

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

SUSE CVE-2026-64344

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

SUSE CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

SUSE CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

SUSE CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

SUSE CVE-2026-64350

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

SUSE CVE-2026-64356

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

SUSE CVE-2026-64357

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfsexchmapsestimateoverhead adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINTMAX check still tests req-resblks. That is the reservation value from before t...

SUSE CVE-2026-64358

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

SUSE CVE-2026-64359

In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEANSEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfstransactionbegin where multiple tasks performing chmod on a nilfs2 mount blocked for over 143 seconds waiting to acquire...

SUSE CVE-2026-64361

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength checkandcorrectrequestedlength compares off + len against nodesize using u32 arithmetic. When the caller passes a large len value e.g. from an underflowed subtractio...

SUSE CVE-2026-64362

In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lgg15data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lgg15event and lgg15v2event do it on th...

SUSE CVE-2026-64363

In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending keyuptimer in remove appleirremove runs hidhwstop before timerdeletesync. hidhwstop synchronously unregisters the HID input device via hiddisconnect - hidinputdisconnect - inputunregisterdevice,...