CVE-2026-72481: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: ak8975: fix potential kernel stack memory leak Currently in the AK8975 driver there are four instances where potential uninitialized kernel stack memory leaks can occur. If i2csmbusreadi2cblockdataoremulated...

PT-2026-72450

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overflow exists in the ASOC SOF ipc3-control component. The ipc control data buffer is allocated using kzallocmax size, but the bounds checks in the bytes ext put and bytes ext ge...

CVE-2026-72262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytesext put/get The ipccontroldata buffer is allocated as kzallocmaxsize, where maxsize covers the entire struct sofipcctrldata including its flexible array payload. However, the...

PT-2026-72493

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in VDUSE where kernel information can be leaked to userspace. This occurs because bouncing is not necessarily page aligned, allowing the mapping of bounce pages to...

SUSE CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

CVE-2026-12366 Use-after-free freeing an armed dynamically-allocated k_timer in Zephyr userspace object disposal

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

SUSE CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

SUSE CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

CVE-2026-12366: Use After Free

Zephyr's dynamic kernel-object disposal path unrefcheck in kernel/userspace/userspace.c frees an object's storage kfreedyn-data once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only KOBJMSGQ and KOBJSTACK; there was no KOBJTIMER case. A...

PT-2026-72078

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description A use-after-free issue exists in the dynamic kernel-object disposal path unref check within kernel/userspace/userspace.c. The system frees an object's storage using k freedyn-data when its...

SUSE CVE-2026-68446

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...

CVE-2026-12232

The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...

CVE-2026-12234 TOCTOU double-fetch in `zsock_sendmsg`/`recvmsg` userspace verifiers allows kernel-heap out-of-bounds write

The userspace syscall verifiers zvrfyzsocksendmsg and zvrfyzsockrecvmsg in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct netmsghdr into a kernel-side copy with kusermodefromcopy, but then re-read the still-live user struct for subsequent decisions. The kernel iovec shadow...

CVE-2026-12232 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties

The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...

CVE-2026-12232

The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...

EUVD-2026-57066

The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...

CVE-2026-12232 Out-of-bounds read via unvalidated stream_id in Intel ALH DAI get_properties

The Intel ALH digital-audio-interface driver function daialhgetproperties in drivers/dai/intel/alh/alh.c used a caller-supplied int streamid with no range validation. The value indexes the fixed-size static const uint8t alhhandshakemap64 array and scales a FIFO register address, so an out-of-rang...

CVE-2026-68446

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmwsurfacemetadata::arraysize This field comes from userspace and should be validated against specific limits depending on which Shader Model SM is available...