SUSE-SU-2026:3149-1 Security update for ffmpeg

This update for ffmpeg fixes the following issue - CVE-2025-10256: NULL pointer dereference in Firequalizer filter bsc1249431...

CVE-2026-63973

A flaw was found in the Linux kernel's mana network driver. During certain error handling scenarios, specifically when network queue allocation fails, the driver attempts to access memory that has already been freed. This can lead to a NULL pointer dereference, causing the system to crash and...

CVE-2026-63990

A flaw was found in the Linux kernel's bonding driver. This vulnerability allows a local user to cause a kernel crash, leading to a Denial of Service DoS, by attempting to enslave a virtual Controller Area Network CAN device to a bonding master. The bonding driver, designed for Ethernet-like...

CVE-2026-64040

A flaw was found in the Linux kernel's cachefiles subsystem. When the vfsmkdir function fails, the system does not correctly extract the error code from the returned error pointer. This improper handling can lead to a null pointer being returned instead of a valid error, potentially causing a...

CVE-2026-64079

A flaw was found in the Linux kernel's netfilter xtables component. A race condition occurs when a network namespace netns table is registered, making it visible with a null operations ops pointer. If a pernet exit operation runs concurrently, it can attempt to unregister the table using this nul...

CVE-2026-64207

A flaw was found in the Linux kernel's DualPI2 Dual-rate PI2 queue discipline. This vulnerability arises from incorrect accounting of Generic Segmentation Offload GSO backlog, where the parent queue such as QFQ - Hierarchical Fair Queueing miscalculates the number of queued packets. This...

CVE-2026-64187

A flaw was found in the Linux kernel's XFS filesystem log recovery component. A local attacker could exploit this vulnerability by crafting a malicious XFS log. When the system attempts to recover from this log, it triggers a null-pointer dereference, which can lead to a system crash. This result...

CVE-2026-53403

A flaw was found in the Linux kernel's framebuffer device fbdev subsystem. When a new modelist is set from userspace, the fbnewmodelist function fails to ensure that the current framebuffer mode remains valid within the updated list. This can lead to a null-pointer dereference if a console attemp...

CVE-2026-53385

A flaw was found in the Linux kernel's vcscreen module. A race condition in the vcswrite function can lead to a null pointer dereference. This occurs when the vcdata pointer becomes stale during concurrent write operations, and a subsequent call attempts to use the now-invalid pointer. A local...

CVE-2026-53382

A flaw was found in the Linux kernel's vidtv media driver. This vulnerability occurs because the vidtvmuxpushsi function does not properly handle a NULL return value from vidtvmuxgetpidctx, which can happen if a PID context fails to allocate during initialization. An attacker could potentially...

CVE-2026-53383

A flaw was found in the Linux kernel's ksmbd component. A remote attacker can trigger a NULL pointer dereference by sending a specially crafted compound SMB2 request. This occurs because the session validation logic for non-first operations in a compound request does not properly check the sessio...

CVE-2026-64107

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC pcm512x chipset driver. This vulnerability occurs due to incorrect handling of kcontrol definitions, leading to a null-pointer dereference. A local attacker could potentially trigger this flaw, causi...

ALSA-2026:42828 Important: httpd:2.4 security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-2853)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's modmd via OCSP response data.CVE-2026-291...

PT-2026-62125

The MCTP-over-I2C+GPIO target binding in Zephyr subsys/pmci/mctp/mctp i2c gpio target.c processes pseudo-register writes from an I2C bus master byte-by-byte in mctp i2c gpio target write received without validating the order or the receive buffer. In the affected versions the MCTP I2C GPIO RX MSG...

EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2026-2849)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately...

EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-2771)

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libexpat before 2.7.5 allows an infinite loop while parsing DTD content.CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer...

MGASA-2026-0283 Updated perl-JavaScript-Minifier-XS package fixes security vulnerabilities

The updated package fixes security vulnerabilities: JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. CVE-2026-56017 JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call...

CVE-2026-64190

In the Linux kernel, the following vulnerability has been resolved: net: team: fix NULL pointer dereference in teamxmit during mode change teamchangemode clears team-ops with memset before restoring safe dummy handlers via teamadjustops. A concurrent teamxmit running under RCU on another CPU can...

CVE-2026-64187

In the Linux kernel, the following vulnerability has been resolved: xfs: fail recovery on a committed log item with no regions If the first op of a transaction is a bare transaction header len == sizeofstruct xfstransheader, xlogrecoveraddtotrans adds an item but no region, leaving it on ritemq...