Security update for chromium (important)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21624-1 Rating: important References: bsc1275913 Cross-References: CVE-2026-76017 CVE-2026-76018 CVE-2026-76019 CVE-2026-76020 CVE-2026-76021...

CVE-2026-74731

In the Linux kernel, the following vulnerability has been resolved: schedext: Skip sub-disable teardown for never-linked sub-schedulers A sub-scheduler enable can fail before scxlinksched links the sched into the hierarchy, e.g. when the parent is already being disabled, and cleanup still runs th...

CVE-2026-74729

In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Fix usercopy overflow in snoopfileread putfifowithdiscard acts as both producer and consumer on the kfifo: it calls kfifoskip advances out and kfifoput advances in from the IRQ handler without synchronizin...

CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

CVE-2026-74726

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...

CVE-2026-74727

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

CVE-2026-74700

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...

CVE-2026-74690

In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ismdevexit A ism interrupt handler can be active in parallel with ismdevexit, accessing freed data structures. No new interrupts will be generated after unregisterieq. Drain ongoing interru...

CVE-2026-74692

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...

CVE-2026-74672

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire initmm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into two broad categories - those ranges where...

CVE-2026-74675

In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...

CVE-2026-74668

In the Linux kernel, the following vulnerability has been resolved: packet: use consistent hardheaderlen in TXRING send path tpacketsnd reads dev-hardheaderlen independently for skb allocation and header construction in tpacketfillskb. Concurrent netdevice reconfiguration can therefore make the...

CVE-2026-74666

In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...

CVE-2026-74658

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent robust futex exit race some more A robust futex unlock stores 0 over the whole futex value - wiping FUTEXWAITERS - and wakes a single waiter. That wakeup is a one-shot notification: the protocol relies on its...

CVE-2026-74662

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

CVE-2026-74647

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list after it is unmapped from DSP. This can create potential race...

CVE-2026-74638

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Serialize the scheduler timeout handlers V3D exposes several independent hardware queues BIN, RENDER, TFU and CSD but has only a single, global reset. A timeout on any one queue therefore has to stop, reset and restart t...

CVE-2026-74646

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: take fl-lock when moving mmaps on interrupted invoke When an invoke is interrupted by a signal, waitforcompletioninterruptible returns -ERESTARTSYS and fastrpcinternalinvoke moves every buffer from fl-mmaps onto...

CVE-2026-74636

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race between updateeventfields and, eventdefinefields The following sequence may leads race between eventdefinefields and updateeventfields: CPU0 loads module A CPU1 loads module B ===============================...