SUSE CVE-2026-99106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: free the userptr ranges when a CS fails after parserbos amdgpucsparserbos allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpucsparserbos...

SUSE CVE-2026-99107

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix incorrect MFT record pointer passed to ntfsattrrecordresize ntfsnewattrflags passes the wrong MFT record to ntfsattrrecordresize. When the attribute is in an extent record, ctx-mrec points to the extent but the function...

SUSE CVE-2026-99108

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix FITRIM range alignment ntfstrimfs aligns the start of a free extent up to the device discard granularity, but derives the discard length by aligning the original extent length down. When the free extent start is not...

SUSE CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source bu...

SUSE CVE-2026-99110

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in cifsdosetacl cifssetacl validates ACL size using posixaclxattrsize: 4 + count 8 // 4-byte header + 8 bytes per ACE cifsdosetacl then calls posixacltocifs to write the CIFS wire format into the sa...

SUSE CVE-2026-99111

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and OTRUNC cifsdotruncate flushes dirty pages with filemapwriteandwait and truncates the file on the server, but in the old code both operations ran without holding irwsem o...

SUSE CVE-2026-99112

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflower: validate mask pointer after nlanext flsetencopt iterates the key's nested tunnel-option attributes with nlaforeachattr while advancing a single mask pointer via nlanext at the bottom of each loop, so the mas...

SUSE CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

SUSE CVE-2026-99114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...

SUSE CVE-2026-99115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the clie...

SUSE CVE-2026-99116

In the Linux kernel, the following vulnerability has been resolved: net: psp: do not inherit the Rx association on clone sk-pspassoc sits past skdontcopyend, so sockcopy copies it into every socket accepted from a listener without taking a reference, while inetsockdestruct puts for every inet...

SUSE CVE-2026-99117

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: don't truncate the port group walk on teardown brmulticastdisableportctx and brmulticastdelport walk port-mglist with hlistforeachentrysafe. However, brmulticastfinddelpg can also delete other entries from the...

SUSE CVE-2026-99118

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using checkmuloverflow before calculating the firmware payload size. Reject zero-length payloads and zero MMI...

SUSE CVE-2026-99119

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: actually validate userq BOs This was supposed to loop over the individual evicted list, as the kernel and alwaysvalid evicted lists were already handled in amdgpuvmvalidate. Without this, BOs that were created a...

SUSE CVE-2026-99120

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Cope with the SS bit being set in NPF exit codes When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS...

SUSE CVE-2026-99121

In the Linux kernel, the following vulnerability has been resolved: ipv4: avoid divide by zero in fibrebalance fibrebalance computes the total eligible nexthop weight in one pass and programs upper bounds in a second pass. A concurrent change to ignorerouteswithlinkdown can make the first pass...

SUSE CVE-2026-99122

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmcitransportrecvstreamcb looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a...

SUSE CVE-2026-99123

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtiotransportrecvpkt looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening...

SUSE CVE-2026-99124

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix leak of uninitialized kernel data in SCLP report While reporterrorwrite checks that the provided buffer is at least as large as the header struct, but not that it is large enough to contain the report with the lengt...

SUSE CVE-2026-99125

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perfeventthrottle -- PMU-stop Shortly later the...