EUVD-2026-55597

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: clamp virtio RX length before skbput hwsimvirtiorxwork passes the virtqueue used-ring length reported by the device straight to skbput on a fixed-size receive skb. A backend reporting a length larger than the...

CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Fix Endpoint Memory Access Descriptor offset calculation Use the descriptor's epmemoffset to calculate the start of the endpoint memory access array and to comply with the FF-A spec instead of defaulting to...

CVE-2026-68392 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take hdev-lock for hciconn lookup and hciabortconn. Don't use RCU to ensur...

CVE-2026-68382 drm/xe/guc: Hold device ref until queue teardown completes

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Hold device ref until queue teardown completes GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock...

CVE-2026-68339 Bluetooth: btusb: validate Realtek vendor event length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

EUVD-2026-55440

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusbrecveventrealtek reads the event code at data0 and the Realtek subevent code at data2 before deciding whether to consume a vendor event as a coredump. For example, the...

EUVD-2026-55421

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68289

CVE-2026-68289 relates to Linux kernel TIPC tipc_recvmsg() and tipc_recvstream() where an integer overflow occurs due to min_t(int, dlen - offset, buflen) when buflen exceeds INT_MAX via io_uring buffers. The fix changes min_t(int, ...) to min_t(size_t, ...) in both functions, ensuring the comput...

EUVD-2026-55371

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

CVE-2026-68252 drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.0: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44...

EUVD-2026-55494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf...

CVE-2026-68110 drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4.4.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc...

SUSE CVE-2026-64598

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

EUVD-2026-53785

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

PT-2026-67669

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free nested frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded vmcs clear, the vCPU might migrate before the pointer is...

Empty NIP-50 search filters can panic

The NIP-50 event-matching path searched event content with slice::windowssearch.len. An empty search string therefore called slice::windows0, which always panics instead of returning a match result. A remote client able to submit filters to an application using this matcher could trigger the pani...

RLSA-2019:3702 Moderate: openssh security, bug fix, and enhancement update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. The following packages have been upgraded to a later upstream version: openssh 8.0p1. BZ1691045 Security Fixe...

PT-2026-66596

Name of the Vulnerable Software and Affected Versions Capsule versions prior to 0.13.8 Description The configuration admission webhook fails to validate the CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex variables...

PT-2026-65848

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey pckmo handler implementation Explicitly check the length of the target buffer in the pkey pckmo implementation of the key to protkey handler function. The handler function fails, if the generated...