SUSE CVE-2026-99160

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU that...

SUSE CVE-2026-99161

In the Linux kernel, the following vulnerability has been resolved: i2c: viai2c-wmt: Fix clock leak in wmti2cprobe In wmti2cprobe, i2c-clk is acquired using ofclkget. If any subsequent operation fails or when the module is unloaded, the clock reference count is never decremented via clkput, leadi...

SUSE CVE-2026-99162

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

SUSE CVE-2026-99163

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

SUSE CVE-2026-99165

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

SUSE CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

SUSE CVE-2026-99167

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

SUSE CVE-2026-99168

In the Linux kernel, the following vulnerability has been resolved: mshvvtl: Check per-CPU register page before mmap Register-page setup is optional for each CPU. If allocation or registration fails, mshvvtlconfigureregpage warns and leaves that CPU's regpage NULL, but initial context setup...

SUSE CVE-2026-99169

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUTOFFMMSHARED A FUTOFFMMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUTOFFINODE waiter can be requeue...

SUSE CVE-2026-99170

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree leaves out can't take over a lock Since commit c62a4766937e "movemount: transfer MNTLOCKED" a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which...

SUSE CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved: ntfs3: free the sbi after a grace period If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfsputsuper and ntfs3killsb drop the in...

SUSE CVE-2026-99172

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

SUSE CVE-2026-99173

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

SUSE CVE-2026-99174

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

SUSE CVE-2026-99175

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

SUSE CVE-2026-99176

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

SUSE CVE-2026-99177

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

SUSE CVE-2026-99178

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

SUSE CVE-2026-99179

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

SUSE CVE-2026-99180

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...