UBUNTU-CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

UBUNTU-CVE-2026-98173

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98177

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

CVE-2026-98165

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: restrict BAR0 fallback read to SR-IOV VFs only The BAR0 fallback read path was introduced as a workaround for SR-IOV VFs where the VRAM aperture is not available during early init. Restrict this workaround to only...

UBUNTU-CVE-2026-98168

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98172

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98169

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots sets retdatalen to sizeofstruct smbsnapshotarray without verifying the actual length of the server's...

CVE-2026-98171

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

CVE-2026-98170

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98178

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpuamdkfdclearkfdmapping assumes that a non-NULL kfddev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example,...

CVE-2026-98174

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98176

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...

CVE-2026-98168

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint In cifsqueryreparsepoint, the start = end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify...

CVE-2026-98173

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98166

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix swapped-out resources never leaving their bulkmove range ttmttswapout returns the number of pages swapped out on success and a negative error code on failure; for a populated ttm it never returns zero. Commit...

CVE-2026-98167

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server-totalread for compound encrypted PDUs In receiveencryptedstandard, server-totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result,...

SUSE-SU-2026:24106-1 Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283...

SUSE-SU-2026:24051-1 Security update for the Linux Kernel RT (Live Patch 15 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283. -...

SUSE-SU-2026:24053-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues: The following security issues were fixed: - CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267370. - CVE-2026-63802: blk-cgroup: fix UAF in blkcgrstatflush bsc1272283. -...