CVE-2026-15891

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

CVE-2026-15891

CVE-2026-15891 is a NULL pointer dereference in the Zephyr RTOS MQTT-SN client. The keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c discards the return value of SYS_SLIST_PEEK_HEAD_CONTAINER, leaving the gw pointer as NULL. The code then dereferences gw->gw_id and passes i...

SUSE CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

SUSE CVE-2026-80993

In the Linux kernel, the following vulnerability has been resolved: net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectpcs can also return an error pointer. This can cause a kernel panic as...

SUSE CVE-2026-89457

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Guard sysfs discipline callbacks against unallocated private data Several sysfs show/store handlers call a discipline callback that dereferences device-private, either directly or through the DASDDEFINEATTR macro. Duri...

SUSE CVE-2026-89460

In the Linux kernel, the following vulnerability has been resolved: s390/cpumcf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpucfevents at first event...

SUSE CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation. numlocks and locknamelen are bounded only on the sending...

SUSE CVE-2026-89511

In the Linux kernel, the following vulnerability has been resolved: qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA continuation fragments. Commit 8a8633978b84 "qede: Add buildskb support...

SUSE CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

SUSE CVE-2026-89727

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICVDIR INTID vgicv2deactivate passes the INTID a guest wrote to GICVDIR straight to vgicgetvcpuirq, and treats a failed lookup as a "can't happen" condition with WARNONONCE. The gues...

Linux Distros Unpatched Vulnerability : CVE-2026-80946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back...

Linux Distros Unpatched Vulnerability : CVE-2026-80939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot Since the hardware rfkill polling was introduced, arm64 platforms can panic with an...

Linux Distros Unpatched Vulnerability : CVE-2026-89746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses t...

Linux Distros Unpatched Vulnerability : CVE-2026-81002

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied...

Linux Distros Unpatched Vulnerability : CVE-2026-89494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: validate lengths in dlmmiglockreshandler A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without...

Linux Distros Unpatched Vulnerability : CVE-2026-89525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the...

Linux Distros Unpatched Vulnerability : CVE-2026-89511

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - qede: Fix NULL pointer dereference in TPA fragment processing Under memory pressure, the qede driver encounters NULL pointer dereferences when processing TPA...

Linux Distros Unpatched Vulnerability : CVE-2026-89581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX....

Linux Distros Unpatched Vulnerability : CVE-2026-80944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller- provided data buffer in cmdnode-databuf. Several callers...

Linux Distros Unpatched Vulnerability : CVE-2026-80993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: phylink: correctly validate returned PCS in phylinkinbandcaps In phylinkinbandcaps, the PCS returned by macselectpcs is only checked if NULL but macselectp...