OPENSUSE-SU-2026:11515-1 ffmpeg-9-libavcodec-devel-9.0.1-1.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-72797

In the Linux kernel, the following vulnerability has been resolved: nvme: fix FDP fdpcidx bounds check The fdpcidx bounds check sets n = NUMFDPC + 1 but used instead of =, incorrectly accepting fdp idx when it equals n i.e. NUMFDPC + 1...

PT-2026-72514

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-demo / etc (SUSE-SU-2026:3615-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3615-1 advisory. Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. - CVE-2026-16243: inconsistent handling of zero length data in arraycm...

PT-2026-72498

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2 ioctl query info validates the PASSTHRU FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bound...

PT-2026-73021

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: widen NAT rewrite delta to s32 in sip help tcp sip help tcp stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more...

Linux Distros Unpatched Vulnerability : CVE-2026-74417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/radeon: fix integer overflow in radeonalignpitch radeonalignpitch has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up...

Linux Distros Unpatched Vulnerability : CVE-2026-74497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result...

Linux Distros Unpatched Vulnerability : CVE-2026-74447

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: fix uint32t overflow in EOP ring buffer size alignment eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers the expected...

PT-2026-72203

In the Linux kernel, the following vulnerability has been resolved: drbd: reject data replies with an out-of-range payload size recv dless read receives a P DATA REPLY from a peer into the bio of an outstanding read request. The peer-supplied payload length reaches it as the signed int data size,...

PT-2026-72490

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Use overflow checks in control update size calc In sof ipc3 control update, the expected size calculation uses firmware-provided cdata-num elems in arithmetic that could overflow on 32-bit platforms,...

PT-2026-72555

In the Linux kernel, the following vulnerability has been resolved: iomap: guard io size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io size tracks only valid data within EOF. This trims io size whe...

PT-2026-72568

In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req id before indexing rsp pvcalls front event handler takes req id directly from the backend-supplied ring response and uses it to index the fixed-size bedata-rsp array for a memcpy and a stor...

PT-2026-72414

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadv tvlv tt vlan data 8 bytes. The size can...

PT-2026-72557

In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minix check superblock uses minix blocks needed to verify that the on-disk imap and zmap block counts are large enough for the advertised inode and zone counts. The helper...

Linux Distros Unpatched Vulnerability : CVE-2026-74469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th...

Linux Distros Unpatched Vulnerability : CVE-2026-72369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - minix: avoid overflow in bitmap block count calculation minixchecksuperblock uses minixblocksneeded to verify that the on-disk imap and zmap block counts are...

PT-2026-72388

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The NTFS mapping-pairs parser accumulates relative Logical Cluster Number LCN deltas using a signed integer. A corrupted attribute can cause this addition to exceed the representable...

PT-2026-72488

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: validate vendor array size before parsing sof parse token sets reads array-size while iterating over topology private data. The loop condition only checks that some data remains, so a malformed topology with ...

PT-2026-72692

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf msg pop data bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l ||...