SUSE CVE-2026-98975

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

SUSE CVE-2026-98978

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

SUSE CVE-2026-98981

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

SUSE CVE-2026-98982

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

SUSE CVE-2026-98988

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

SUSE CVE-2026-98990

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

SUSE CVE-2026-98994

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

SUSE CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

SUSE CVE-2026-98999

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

SUSE CVE-2026-99001

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: cancel the client work on remove xei2cnotifier stores the DesignWare adapter in i2c-adapter and schedules i2c-work when the adapter is registered under the xe I2C platform device, and xei2cclientwork then instantiates...

SUSE CVE-2026-99002

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...

SUSE CVE-2026-99004

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

SUSE CVE-2026-99012

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

SUSE CVE-2026-99013

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

SUSE CVE-2026-99016

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

SUSE CVE-2026-99021

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

SUSE CVE-2026-99026

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

SUSE CVE-2026-99027

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

SUSE CVE-2026-99028

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

SUSE CVE-2026-99030

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...