PT-2026-117604

These are all security issues fixed in the forgejo-17.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116873

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atomize IRQ register read/modify/write ops Why The OTG GLOBAL SYNC STATUS register controls various HW IRQ sources for the output timing generator OTG. VUPDATE NO LOCK is one of them. To enable the IRQ, driver se...

PT-2026-116552

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types...

PT-2026-116554

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyon...

PT-2026-117010

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AF XDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to mlx5e xs...

PT-2026-116777

In the Linux kernel, the following vulnerability has been resolved: net: flush skb defer nodes in dev cpu dead When a CPU goes offline, dev cpu dead drains its softnet queues completion queue, output queue, poll list, process queue, and input pkt queue, but leaves net hotdata.skb defer nodes...

PT-2026-116666

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

PT-2026-117013

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

PT-2026-116542

A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career Portal. This manipulation of the argument applyToJobSubAction causes improper restriction of excessive authentication attempts. Remote exploitation of...

PT-2026-116793

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenet netif stop and the Wake-on-LAN branch of bcmgenet suspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls netif ...

PT-2026-116672

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2 open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2 parse contexts rejects malformed context data, SMB2 open...

PT-2026-116868

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroy pages crste Use READ ONCE in destroy pages crste to read the crste, avoid dereferencing the pointer multiple times...

PT-2026-116923

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

PT-2026-117022

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dma buf sz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer sec page was only allocated and programmed...

PT-2026-116775

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gve prep tso notes that the device requires the MSS to be len and gso segs, never gso size. Such a packet reaches gve tx fill tso ctx desc, which puts gso size into the mss...

PT-2026-116935

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted Use the MSR permission bitmap of the active VMCB instead of assuming that KVM is always using vmcb02's bitmap when L2 is active, as KVM uses msrpm02 i...

PT-2026-116665

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hidden space go negative in xfs metafile resv init LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hidden space...

PT-2026-116852

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp process fw dump When CONFIG DEV COREDUMP=n, hci devcd append returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxp set ind reset from being...

PT-2026-116787

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan na create samples LL RESERVED SPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlan changelink can update needed headroom betwee...

PT-2026-116589

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29...

PT-2026-117006

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtab map lookup and delete batch bpf mem cache free rcu uses this cpu ptr which requires migration to be disabled. All callers of rhtab delete elem disable migration except rhtab map look...

PT-2026-117167

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

PT-2026-116780

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp net ipsec rx drops the XArray lock before taking a reference to the xfrm state it found. The delete path can erase the entry and drop the last state reference in that interval. R...

PT-2026-117605

These are all security issues fixed in the freetype2-devel-2.15.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-116812

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug info copy When debug register static fails, it clears areas, active pages and active entries but leaves the area bounds unchanged. Copying such an area, either by opening its view...

PT-2026-116752

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe bdev setintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU...

PT-2026-117066

In the Linux kernel, the following vulnerability has been resolved: rtc: spear: initialize IRQ state before requesting alarm IRQ devm request irq enables the interrupt before it returns, so the handler may run while probe is still initializing the device. Initialize the MMIO address and spinlock...

PT-2026-116779

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rds conn create computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

PT-2026-117087

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cache replay, the writeback worker and the GC worker read a kset of get kset onmedia size bytes and advance the position by it. A forged key num makes that size exceed the...

PT-2026-117004

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc state create copy for NULL in dm suspend dc state create copy can return NULL on allocation failure. dm suspend only conditionally skips dm gpureset toggle interrupts and continues execution, returning...

PT-2026-116932

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEAT FGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvm calculate trap...

PT-2026-117064

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

PT-2026-116628

A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get obj from str of the file modules/sd models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. The attack can be initiated remotel...

PT-2026-116668

Content removed...

PT-2026-116823

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn bind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

PT-2026-117611

These are all security issues fixed in the python313-vllm-0.32.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117598

These are all security issues fixed in the ansible-core-2.21.5-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-117021

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advance nextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6 next csid advance arg...

PT-2026-116880

In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix infinite delay on error When reading an integration-time fails, the code will use error code to compute the sleep time. Fix this by using the smallest integration time as a default if reading fails...

PT-2026-116962

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream config-type stream config is not initialized before being passed to sdw stream add slave. The type field may contain garbage and is later copied to stream-type by sdw config...

PT-2026-116728

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio gpu execbuffer ioctl reserves a DRM event with drm event reserve init when VIRTGPU EXECBUF RING IDX selects a ring that userspace has enabled polling for...

PT-2026-116712

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic dhcp init options appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootp pkt.exten buffer. Only the client-ID branch...

PT-2026-116952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci core: Serialize fragmented ISO packet queueing The fragmented path in hci queue iso calls skb queue tail without holding conn-data q.lock. The socket lock serializes senders, but the transmit worker can concurrentl...

PT-2026-116982

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep in and ep out for non-ep0 control endpoints In usb enable endpoint, non-zero control endpoints where usb endpoint xfer control&ep-desc is true populate both dev-ep inepnum and dev-ep outepnum with the sam...

PT-2026-116968

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100 shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100 shutdow...

PT-2026-117027

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcm sysport get stats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcm sysport get stats. The variable 'j' tracks the compacted index into the...

PT-2026-116817

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6 insert exception for dying fib6 info. Before the cited commit, fib6 nh flush exceptions always set from-exception bucket flushed = 1 under rt6 exception lock to prevent rt6 insert exception from inserting a new...

PT-2026-117014

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5 ptp init returns early on the base lan969x variants because they do not have the SPX5 FEATURE PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding...

PT-2026-117003

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx v6 0 init microcode is not released when the GFX block is torn down, leaking the firmware resources. Add gfx v6 0 free microcode and call it from gfx v6...

PT-2026-117055

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6 ISO PACKETS max packet size out bytes, sized from the OUT endpoint, but the number of bytes written into that...