SUSE CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

SUSE CVE-2026-98129

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

SUSE CVE-2026-98132

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

SUSE CVE-2026-98133

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

SUSE CVE-2026-98136

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...

SUSE CVE-2026-98139

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

SUSE CVE-2026-98141

In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure updatereparsedata ignores the return value of setreparseindex. When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink2...

SUSE CVE-2026-98143

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPUSETIFM,OFMPRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser h...

SUSE CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

SUSE CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

SUSE CVE-2026-98147

In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthreadrun failure. Since kthreadcreateonnode returns -EINTR upon SIGKILL, we should not use WARNON in order to catch kthreadrun failure...

SUSE CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

SUSE CVE-2026-98149

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

SUSE CVE-2026-98151

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

SUSE CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

SUSE CVE-2026-98153

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

SUSE CVE-2026-98154

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

SUSE CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

SUSE CVE-2026-98157

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

SUSE CVE-2026-98159

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...