SUSE CVE-2026-98665

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

SUSE CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

SUSE CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

SUSE CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

SUSE CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

SUSE CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

SUSE CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

SUSE CVE-2026-98841

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

SUSE CVE-2026-98854

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

DEBIAN-CVE-2026-98616

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn-numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend tears the datapath down via...

DEBIAN-CVE-2026-98523

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

DEBIAN-CVE-2026-98477

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task context is scheduled in on this CPU. perfpmuschedtask therefore always...

DEBIAN-CVE-2026-98796

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

DEBIAN-CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

DEBIAN-CVE-2026-98849

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

DEBIAN-CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

DEBIAN-CVE-2026-98676

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

DEBIAN-CVE-2026-98522

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

DEBIAN-CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

DEBIAN-CVE-2026-98580

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...