CVE-2026-74256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-72369: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

CVE-2026-72302: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in controlupdate size calc In sofipc3controlupdate, the expectedsize calculation uses firmware-provided cdata-numelems in arithmetic that could overflow on 32-bit platforms, wrapping t...

OPENSUSE-SU-2026:11521-1 libgit2-1_9-1.9.7-1.1 on GA media

These are all security issues fixed in the libgit2-19-1.9.7-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-72298: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtrendpointpost qrtrendpointpost validates an incoming packet with if !size || len != ALIGNsize, 4 + hdrlen goto err; where size comes from the wire. On 32-bit, sizet is 32 bits and...

CVE-2026-74297: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size setrqsize computes the RQ WQE size as "1 rqwqeshift" based on the user-provided rqwqeshift, which is only checked to be greater than 32, so shifts of 32 are still accepted. A shi...

CVE-2026-72310: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2ioctlqueryinfo validates the PASSTHRUFSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds...

PT-2026-72899

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the drm/amdkfd component when aligning the EOP ring buffer size. In the kfd queue acquire buffers function, the eop ring buffer size variable within the que...

PT-2026-72294

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow occurs in the dm-log component on 32-bit architectures. The issue arises during the calculation of the bitset size variable, which is used for bitmap memory allocatio...

PT-2026-72555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iomap component where a concurrent truncate operation can cause an unsigned wrap of the io size variable. This occurs when end pos falls below ioend-io offset duri...

PT-2026-72388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The NTFS mapping-pairs parser accumulates relative Logical Cluster Number LCN deltas using a signed integer. A corrupted attribute can cause this addition to exceed the representable...

PT-2026-73022

In the Linux kernel, the following vulnerability has been resolved: ntfs: harden runlist realloc size calculations Add a shared helper to safely convert runlist element counts to byte sizes using overflow checks, and use it in both ntfs rl realloc and ntfs rl realloc nofail...

PT-2026-72488

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC SOF topology parsing where the sof parse token sets function reads the array-size field while iterating over topology private data. Because the loop condition...

CVE-2026-74380: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix iommumapsgtable return value check Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a zero. pinj...

PT-2026-72540

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the hid bpf get data function. The function returns a pointer to HID-BPF context data if the provided offset and size are within the ctx-allocated size...

PT-2026-72222

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the orangefs component. The fill from part function calculates the size of a directory entry using size t but stores the result in a u32 variable. If an...

PT-2026-72514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CAKE Common Applications Kept Enhanced queuing discipline where signed overhead values are stored in an s16 type, but the adjusted packet length calculation utiliz...

PT-2026-72498

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the SMB client during the validation of the PASSTHRU FSCTL response payload within the smb2 ioctl query info function. The issue occurs because the...

PT-2026-72191

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth component where the rtlbt parse firmware function fails to properly validate firmware patch bounds. When processing a malformed firmware patch shorter th...

CVE-2026-74256: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...