CVE-2026-80621: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

PT-2026-82936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter conntrack component where the ct extension genid infrastructure disables all ct extensions for unconfirmed conntracks. This occurs because the...

PT-2026-82984

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the KVM s390 PCI component when the airq iv create function fails to allocate an AIBV Airq Interrupt Vector and returns NULL. Because the return value was no...

CVE-2026-80684: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

PT-2026-86691

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airq iv create can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvm zpci set...

PT-2026-82978

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition and error handling flaw exist in the i2c imx driver. In the i2c imx reg slave function, the slave pointer is assigned before the pm runtime resume and get function is...

openSUSE 16 Security Update : libarchive (openSUSE-SU-2026:21631-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21631-1 advisory. - Fix creation of temporary files in target directory bsc1254340 - Fix out-of-bounds buffer overrun when using pHLEVELOFFSET bsc1254341 - Fix buffer...

PT-2026-82964

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter module, the xt nat SNAT and DNAT target handlers assume that IP-family conntrack state is present. When instantiated from an unsupported family through nft compat, such ...

SUSE CVE-2026-72392

In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6walkcontinue on multi-batch dump inet6dumpfib saves its progress in cb-args1 as a positional index within the current hash chain. Between batches, a concurrent fib6newtable can insert a new table...

SUSE CVE-2026-72424

In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313rtcprobe calls devmrequestirq with IRQFSHARED and &pdev-dev as the cookie, but platformsetdrvdata is only called later after the clock setup. With a shared IRQ line...

SUSE CVE-2026-72446

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: reject stream disable with no active interface handleuaudiostreamreq resolves an interface index with infoidxfromifnum, which returns -EINVAL when no interface matches. The enable branch and the response:...

SUSE CVE-2026-74387

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize output teardown with eventinput eventprocessmidi borrows msynth-outputrfile.output and then passes the substream to dumpmidi and sndrawmidikernelwrite without synchronizing with the output open/close...

SUSE CVE-2026-74395

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74740

A flaw was found in the Linux kernel's network scheduler net/sched: actapi. A Time-of-Check to Time-of-Use TOCTOU race condition exists where a pointer can be cleared between two reads. This allows a concurrent operation to cause a NULL dereference, potentially leading to a system crash and Denia...

CVE-2026-80520

A flaw was found in the ovpn module of the Linux kernel. The ovpncryptokillkey function incorrectly assumes that both crypto key slots are always populated. This can lead to a NULL dereference if a peer has only one installed key or if the function attempts to remove a key that is not present. A...

EUVD-2026-66586

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

SUSE CVE-2026-72035

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace direct dequeue call with peek and qdiscdequeuepeeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb; tapriodequeuefromtxq then tak...

SUSE CVE-2026-72094

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes tag below introduced a mechanism through which fence producers can fully decouple from fence consumers. This, desirable, mechanism is...

SUSE CVE-2026-74740

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: fix TOCTOU NULL deref on a-gotochain tcfactionexec handles TCACTGOTOCHAIN by first checking rcuaccesspointera-gotochain and then calling tcfactiongotochainexec, which does a second, independent...

SUSE CVE-2026-80520

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...