SUSE CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

SUSE CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

SUSE CVE-2026-64321

In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmetrdmaqueueconnect calls nvmetrdmafindgetdevice which acquires a reference on the returned ndev via krefget. On the path where the host queue backlog is exceeded and...

SUSE CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

SUSE CVE-2026-64348

In the Linux kernel, the following vulnerability has been resolved: usb: free iso schedules on failed submit EHCI and FOTG210 isochronous submits build an ehciisosched before linking the URB to the endpoint queue, and keep the staged schedule in urb-hcpriv until isostreamschedule and the link...

SUSE CVE-2026-64366

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacomwacqueueinsert wacomwacqueueinsert calls kfifoskip in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty, kfifoskip reads stale data lef...

SUSE CVE-2026-64406

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in btacceptdequeue btacceptget takes a temporary reference before dropping the accept queue lock. btacceptdequeue currently drops that reference before btacceptunlink, leaving only the queue reference...

SUSE CVE-2026-64414

In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments such as from devmem TCP, where skbfragsreadableskb returns false is processed by the u32 module, skbcopybits will safely return a negative...

SUSE CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue - skbunlin...

CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

CVE-2026-64337

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3gadgetqueue maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request...

CVE-2026-64321

In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmetrdmaqueueconnect calls nvmetrdmafindgetdevice which acquires a reference on the returned ndev via krefget. On the path where the host queue backlog is exceeded and...

CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64260

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

UBUNTU-CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue → skbunlin...

UBUNTU-CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...

UBUNTU-CVE-2026-64457

In the Linux kernel, the following vulnerability has been resolved: virtiopci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 /sys/bus/virtio/drivers/virtioballoon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer...

UBUNTU-CVE-2026-64321

In the Linux kernel, the following vulnerability has been resolved: nvme: target: rdma: fix ndev refcount leak on queue connect nvmetrdmaqueueconnect calls nvmetrdmafindgetdevice which acquires a reference on the returned ndev via krefget. On the path where the host queue backlog is exceeded and...