SUSE CVE-2026-74633

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in module event cache removal A module-only event filter such as ":mod:foo" is cached with a NULL eventmod-match when foo has not been loaded. If a later write tries to remove a specific matc...

SUSE CVE-2026-74634

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

SUSE CVE-2026-74635

In the Linux kernel, the following vulnerability has been resolved: fbdev: bitblit: bound-check glyph index in bitcursor bitcursor fetches the glyph under the cursor with c = scrreadwvcpos; src = vcfont.data + c & charmask w height; where charmask is 0x1ff when vchifontmask is set. The screen...

SUSE CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...

SUSE CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

SUSE CVE-2026-74640

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: fix OOB write in fcpmeterctlget fcpioctlsetmetermap bounds the user-supplied Level Meter map size by the driver's own limit of 255 if map.mapsize 255 || map.meterslots 255 return -EINVAL; and passes it to fcpaddnewctl ...

SUSE CVE-2026-74641

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctlssharedmem + offset; page = virttopagevaddr; getpagepag...

SUSE CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

SUSE CVE-2026-74643

In the Linux kernel, the following vulnerability has been resolved: samples/damon/mtier: error out for zero quota goal target values Patch series "mm/damon: avoid division by zero from damosquotascore". DAMONSAMPLEMTIER and DAMONLRUSORT allow the user to trigger division by zero in damosquotascor...

SUSE CVE-2026-74644

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...

SUSE CVE-2026-74645

In the Linux kernel, the following vulnerability has been resolved: mm/damon/lrusort: error out for 10000 activemembp damosquotascore can trigger division by zero if the target value is zero. DAMONLRUSORT lets users set the target value for the hot memory scheme via activemembp parameter. It avoi...

SUSE CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

SUSE CVE-2026-74648

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

SUSE CVE-2026-74650

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

SUSE CVE-2026-74651

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

SUSE CVE-2026-74653

In the Linux kernel, the following vulnerability has been resolved: serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx The NXP LPC32xx UART PORTLPC3220 can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT 0x0c but LSR.DR is clear. A...

SUSE CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dma: Clear stale RX state on shutdown serial8250releasedma terminates RX DMA and releases the channel, but leaves rxrunning set. If the port is closed while an RX transfer is active, the stale state remains while rxch...

SUSE CVE-2026-74655

In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer...

SUSE CVE-2026-74656

In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fibnhcupdatemtu fibnhcupdatemtu walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcudereferenceprotected with a constant tr...

SUSE CVE-2026-74657

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix fibnlmsgsize for RTAVIA nexthops fibnlmsgsize still estimates nexthop space as if every gateway is encoded as an IPv4 RTAGATEWAY attribute. IPv4 routes can also carry an IPv6 gateway, which fibnexthopinfo dumps as RTAVI...