SUSE CVE-2026-93113

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCCGDSCCLK With the introduction of syncstate support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: 15.408367...

SUSE CVE-2026-93117

In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentati...

SUSE CVE-2026-93118

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: check endpoint DMA allocation astudcprobe allocates a coherent DMA buffer used as the backing store for endpoint buffers. astudcinitep derives per-endpoint buffer pointers from udc-ep0buf, so a failed...

SUSE CVE-2026-93125

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

SUSE CVE-2026-93129

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-base: Fix handling of ultra performance key The commit message of commit 5fbd827eb9c2 "platform/x86: dell-wmi: Recognise or support new switches" states that the ultra performance key contains additional da...

SUSE CVE-2026-93134

In the Linux kernel, the following vulnerability has been resolved: printk: Fix possible console use-after-free When emitting a record via legacy printing, it is possible that a handover to another legacy printing context occurs. When a context has performed a handover, the console SRCU read lock...

SUSE CVE-2026-93135

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

SUSE CVE-2026-93137

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mmstruct in bpffindvma bpffindvma reads task-mm and calls mmapreadtrylockmm without holding a reference on the mm. On a foreign task, a concurrent exitmm can free the mmstruct between the lockless read...

SUSE CVE-2026-93139

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/mes: Fix hungqueuedbarray loop limit for multi-XCC The loop iterated only AMDGPUMAXMESPIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed b...

SUSE CVE-2026-93141

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: r8a66597: avoid double free of ep0req in probe error path If usbaddgadgetudc fails, r8a66597probe jumps to erraddudc and frees ep0req, then falls through to cleanup2 where ep0req is freed again when it is non-NULL...

SUSE CVE-2026-93142

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/rcar: Fix error checking in probe This code accidentally calls thermalzonedeviceenable before checking whether thermalzonedeviceregisterwithtrips failed. Move the call until later to avoid an error pointer...

SUSE CVE-2026-93144

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

SUSE CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

SUSE CVE-2026-93148

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject MEMALLOC BTF accesses past object bounds BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTRTOBTFID | MEMALLOC values point...

SUSE CVE-2026-93149

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

SUSE CVE-2026-93150

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Make nrdeadlinetasks an atomict The nrdeadlinetasks variable in the cpuset structure was introduced by commit 6c24849f5515 "sched/cpuset: Keep track of SCHEDDEADLINE task in cpusets". It is reported by sashiko 1 th...

SUSE CVE-2026-93152

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state applenvmeinitqueue initializes queue state and then marks the queue enabled. The interrupt and request paths check enabled before using that queue state. The old wmb after...

SUSE CVE-2026-93154

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

SUSE CVE-2026-93155

In the Linux kernel, the following vulnerability has been resolved: crypto: keembay - Fix AEAD unregister count in error path registeraesalgs registers the AEAD algorithms before registering the skcipher algorithms. If skcipher registration fails, the function unwinds the earlier AEAD registratio...

SUSE CVE-2026-93157

In the Linux kernel, the following vulnerability has been resolved: hwrng: xilinx-trng - propagate timeout before any data is read xtrngreadblock32 polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short...