CVE-2026-74753

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-80589 block: stop the timeout timer when releasing a never added disk

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...

CVE-2026-80574 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltechprocessrelpacket Make finger2 and also finger1 unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the...

CVE-2026-80575

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50add copies the custom data of an FFPERIODIC/FFCUSTOM effect straight from the ffeffect the user passed to EVIOCSFF, without requiring it to hold anything:...

CVE-2026-80553

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Cancel existing workqueues The initialization of the iowork and crwwork workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in releasedev to ensure work isn't...

CVE-2026-80550

In the Linux kernel, the following vulnerability has been resolved: s390/vfioccw: Fix out of bounds check on CCW array The routine ccwchaincalclength counts the number of channel command words CCWs that are chained together in a single channel program, and rejects anything larger than...

CVE-2026-80534

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...

CVE-2026-80522 crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80522

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx-cryptlen calculation in tegragcmdoonereq Perform rctx-cryptlen calculation in tegragcmdoonereq the same way it is done in tegraccmcryptinit. The current formulae may lead to a crash if a caller does not...

CVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

CVE-2026-74753 perf: Reject exited events as group leaders

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perfeventremoveonexec sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perfeventopen...

CVE-2026-74754 scsi: core: pair EH runtime PM get and put

In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once again before scsiautopmputhost. That is racy when a PM-triggered err...

CVE-2026-74754

In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost-ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost and once again before scsiautopmputhost. That is racy when a PM-triggered err...

CVE-2026-74748

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...

CVE-2026-74749

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...

CVE-2026-74738

In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an unset readablereg callback regmapsdwmbqpollbusy decides whether to poll the Function Busy bit by calling ctx-readablereg, which is a straight copy of config-readablereg. That callback is optional:...

CVE-2026-74734

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointer dereference in arcontextrelease During the error handling path of the driver's probe function, a NULL pointer dereference can occur in arcontextrelease. When pciprobe fails early e.g., if...

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1255616. CVE-2026-23204: net: add skbheaderpointercareful helper bsc1258340. CVE-2026-52986: netfilter:...

CVE-2026-58093

The FreeBSD kernel contains a use-after-free vulnerability in the tty module's TIOCSCTTY ioctl handler. The issue stems from a race condition where the handler drops the tty lock to acquire the process tree lock but fails to revalidate the terminal's state upon reacquiring the lock. This allows a...

CVE-2026-58091 Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...