SUSE-SU-2026:4115-1 Security update for strongswan

This update for strongswan fixes the following issues: - CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities bsc1266360. - CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. - CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7...

CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

CVE-2026-80923

CVE-2026-80923 is a use-after-free in the Linux kernel's xhci dbgtty driver. When tty_register_driver() fails during module initialization, the driver reference is dropped but the global dbc_tty_driver pointer is left dangling (not set to NULL). Upon module unload, dbc_tty_exit() sees the non-NUL...

CVE-2026-80923 xhci: dbgtty: Fix unregister on tty_register_driver() failure

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on ttyregisterdriver failure If ttyregisterdriver fails, it drops the reference, but fails to set the global dbcttydriver to NULL, causing the unregister to be called again when module exits. On modul...

CVE-2026-80918 HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

EUVD-2026-75093

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80918

CVE-2026-80918 is a type-confusion bug in the Linux kernel HID core subsystem. When hid_scan_report() calls fetch_item() on an item tagged HID_ITEM_TAG_LONG, the data is stored as a pointer in item->data.longdata rather than as a value. However, item_udata() and item_sdata() assume the item is...

CVE-2026-80917

This Linux kernel vulnerability affects the PCI host-generic driver on 32-bit CAM (legacy) systems using the pci-host-cam-generic device-tree binding. The root cause is that the CAM ops in pci-host-generic.c lack the ->add_bus/->remove_bus callbacks present in the generic ECAM ops. On 32-bi...

CVE-2026-80918 HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate maps each bus segment separately and relies on the -addbus callback...

EUVD-2026-75092

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate maps each bus segment separately and relies on the -addbus callback...

CVE-2026-80917 PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate maps each bus segment separately and relies on the -addbus callback...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

CVE-2026-80914 Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-free of listener socket in isoconnready isoconnready looks up the BIS listener socket with isogetsock, which takes a reference, and then, without re-checking its state, creates a child socket from it...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

DEBIAN-CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-87877

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

CVE-2026-87877 zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...

EUVD-2026-75024

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM...