SUSE CVE-2026-98942

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

SUSE CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

SUSE CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

SUSE CVE-2026-98977

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

SUSE CVE-2026-98983

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces and copynamespaces and dropped...

SUSE CVE-2026-99011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

SUSE CVE-2026-99017

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

SUSE CVE-2026-99022

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

SUSE CVE-2026-99039

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

SUSE CVE-2026-99061

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

SUSE CVE-2026-99070

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

SUSE CVE-2026-99088

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr calls updateipv6checksum. If parseipv6hdr processes a non-first IPv6 fragment, it sets...

SUSE CVE-2026-99089

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable opclk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets priv-opclk to the parent of the RCLKSRC m...

SUSE CVE-2026-99091

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmdcompletersp receives a struct cmdlookup and, for a pending command that has no cmdcomplete callback, falls through to cmdstatusrspcmd, data. cmdstatusrsp rea...

SUSE CVE-2026-99093

In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftracefilter=pudfreepmdpage panics on 7.3-rc4 as soon as the tracer starts:...

SUSE CVE-2026-99094

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix TX descriptor bounds check btintelpciepreparetx uses tfdindex to access the TFD and data buffer arrays before the index is advanced modulo txq-count. An index equal to txq-count is one past the end of...

SUSE CVE-2026-99096

In the Linux kernel, the following vulnerability has been resolved: iouring/register: don't exempt disabled rings from task restrictions A ring created with IORINGSETUPRDISABLED is exempt from its register restrictions until it is enabled. This lets the creator register the restrictions and then...

SUSE CVE-2026-99097

In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in teedynshmallochelper teedynshmallochelper derives nrpages from a caller-supplied size and passes it to allocpagesexact without checking it. For size == 0 nrpages is 0, and allocpagesexac...

SUSE CVE-2026-99098

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dmintegritycheck and dmintegrityinlinerecheck compute the checksum of each block into an on-stack buffer of HASHMAXDIGESTSIZE bytes...

SUSE CVE-2026-99099

In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum 1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present...