SUSE CVE-2026-74685

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Clamp negative current limits When a negative value is passed to ltc4282writecurr, the signed long val is cast directly to u64: drivers/hwmon/ltc4282.c:ltc4282writecurr / need to pass it in millivolt / u32 in =...

SUSE CVE-2026-74687

In the Linux kernel, the following vulnerability has been resolved: watchdog: at91sam9wdt: prevent timer rearm during teardown at91ping rearms the watchdog timer from its callback. timerdelete neither waits for a running callback nor prevents it from rearming the timer, so probe failure or driver...

SUSE CVE-2026-74688

In the Linux kernel, the following vulnerability has been resolved: sctp: clear control chunk transport if it is being removed sctpmakeheartbeatack caches the destination transport in chunk-transport without taking a reference. When srcoutofasocok is enabled, the HEARTBEAT ACK may remain queued o...

SUSE CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

SUSE CVE-2026-74691

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Tear down DMA paths before stopping the rings tbnetteardown stops both rings and frees their frame buffers before calling tbxdomaindisablepaths. tbringstop zeroes the ring's descriptor base and tbnetfreebuffers...

SUSE CVE-2026-74692

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

SUSE CVE-2026-74694

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

SUSE CVE-2026-74697

In the Linux kernel, the following vulnerability has been resolved: bnxten: Disable EOP for TPA on all chips to prevent data corruption EOP End of frame padding on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering RO is...

SUSE CVE-2026-74699

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in execqueuesethangreplaystate The q-replaystate is blindly overwritten, which can potentially leak memory that was previously allocated by vmemdupuser. Return an error if q-replaystate is not empty...

SUSE CVE-2026-74700

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...

SUSE CVE-2026-74701

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in keyextract When a packet arrives on an ARPHRDNONE device e.g. TUN, ovsflowkeyextract trusts the user-provided skb-protocol field: if it is ETHPTEB, the packet is classified as...

SUSE CVE-2026-74704

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

SUSE CVE-2026-74705

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skbudptunnelsegment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

SUSE CVE-2026-74706

In the Linux kernel, the following vulnerability has been resolved: bnge: Fix NULL pointer dereference in aux device release If allocation of auxrdev fails during auxiliary device setup, the error path calls auxiliarydeviceuninit, which eventually invokes bngeauxdevrelease. The release callback...

SUSE CVE-2026-74707

In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...

SUSE CVE-2026-74708

In the Linux kernel, the following vulnerability has been resolved: xsk: validate launch-time metadata size Launch-time metadata extends beyond the first 16 bytes of struct xsktxmetadata. Reject the request when the registered metadata area does not contain the complete field. Snapshot the...

SUSE CVE-2026-74709

In the Linux kernel, the following vulnerability has been resolved: xsk: clear metadata pointer when no timestamp is requested User space can change metadata flags after request processing. Rereading them during completion can therefore make the kernel write a timestamp that was not requested whe...

SUSE CVE-2026-74710

In the Linux kernel, the following vulnerability has been resolved: xsk: require at least 16 bytes of TX metadata AFXDP accepts a TX metadata length as small as eight bytes, but every supported request needs the flags plus at least one eight-byte request field. Such short metadata also lets the...

SUSE CVE-2026-74712

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix buffer length in createdirectkeys We have seen in our CI the following KASAN message: BUG: KASAN: slab-out-of-bounds in cmdexec+0x550/0xca0 mlx5core Read of size 272 at addr 0000000176795020 by task...

SUSE CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...