CVE-2026-90092

CVE-2026-90092 is a use-after-free vulnerability in the Linux kernel Bluetooth L2CAP subsystem. The root cause is a race condition between l2cap_sock_new_connection_cb() and the parent l2cap_chan teardown: when chan->state is accessed without consistent locking, a new socket can be added to th...

CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

CVE-2026-90092 Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90093

CVE-2026-90093 is a use-after-free bug in the Linux kernel Bluetooth L2CAP subsystem. Since commit b66774b48dd9, l2cap_chan::conn retains a reference that remains non-NULL even after the corresponding hci_conn is deleted. Accessing fields such as hci_conn::hdev in this state causes a KASAN crash ...

EUVD-2026-81953

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

CVE-2026-90079 octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix cn20k mailbox lifetime on repeated rvumboxinit rvumboxinit is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ngrvu object,...

CVE-2026-90079

CVE-2026-90079 affects the octeontx2-af driver in the Linux kernel. The root cause is a memory-lifecycle bug in rvu_mbox_init(), which is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call allocated a new ng_rvu object, leaking the first a...

EUVD-2026-81940

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix cn20k mailbox lifetime on repeated rvumboxinit rvumboxinit is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ngrvu object,...

EUVD-2026-81932

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

CVE-2026-90071

CVE-2026-90071 is a use-after-free (UAF) in the Linux kernel's TEQL (Traffic Engineering Load Balancing) QoS scheduler (net/sched/sch_teql). The function teql_master_xmit() sets skb->dev to the current slave before attempting transmit but fails to restore it when the transmit fails. The skb th...

CVE-2026-90071 net/sched: sch_teql: restore skb->dev on the slave failure path

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

CVE-2026-90071 net/sched: sch_teql: restore skb->dev on the slave failure path

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

CVE-2026-90057 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

CVE-2026-90057

CVE-2026-90057 is a slab-use-after-free in the Linux kernel's SLIP line discipline . The root cause is a race between slip_hangup() and reader functions such as slip_receive_buf(): tty_ldisc_hangup() held only a read lock on tty->ldisc_sem, allowing slip_close() to run concurrently with reader...

CVE-2026-90057 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

EUVD-2026-81918

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

SUSE-SU-2026:4254-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsyn...

SUSE-SU-2026:4250-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2026-6368: invalid free via wordexp WRDEAPPEND rollback bsc1274726. - CVE-2026-6791: stack overflow in wordexp tilde expansion bsc1274723. - CVE-2026-18374: heap buffer overflow in the fopen ccs extension bsc1277262. - CVE-2026-19499: buffer...

kernel: ALSA: timer: Fix UAF at snd_timer_user_params()

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA timer component. A race condition can occur during the release of a timer object, specifically when the SNDRVTIMERIOCTLPARAMS ioctl is called concurrently. This can lead to a use-after-free vulnerability, potentially...

kernel: ALSA: seq: Serialize UMP output teardown with event_input

A flaw was found in the Advanced Linux Sound Architecture ALSA sequencer component of the Linux kernel. This vulnerability, a use-after-free, occurs because of improper synchronization when handling Universal MIDI Packet UMP output. A local attacker could exploit this by creating a specific timin...