SUSE CVE-2026-98433

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uvpagein failure In kvmppcsvmpagein, if uvpagein fails after kvmppcuvmemgetpage has succeeded, the secure device page is never released. kvmppcuvmemgetpage sets a bit in...

SUSE CVE-2026-98434

In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in procdointvecmsjiffiesminmax Add the range check to doprocintconvmsjiffiesminmax that commit d174174c6776 "sysctl: replace SYSCTLINTCONVCUSTOM macro with functions" incorrectly removed...

SUSE CVE-2026-98437

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: fix runtime PM reference leaks Use pmruntimeresumeandget in irisenablepowerdomains to avoid leaking a runtime PM usage count on failure. Also ensure pmruntimeputsync is always called in irisdisablepowerdomains,...

SUSE CVE-2026-98438

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: fix uninit-value in mptcpwritedatafin When sending a DATAFIN without data, and because the DATAFIN occupies 1 octet of the connection-level sequence space 1, it is then required to add a DSS mapping with specific...

SUSE CVE-2026-98439

In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async request may still be waiting when a connection is closed. This can stop the connection from closing. Cancel active async requests before waiting for them to finis...

SUSE CVE-2026-98440

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction We free the shadow S2 structures from kvmarchflushshadowall, which is a Bad Ideatm. Freeing the page tables is fair game this is what this callback is for...

SUSE CVE-2026-98441

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

SUSE CVE-2026-98442

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

SUSE CVE-2026-98443

In the Linux kernel, the following vulnerability has been resolved: xfs: fix cursor and pointer handling when recovering iunlink buckets LOLLM pointed out a bug in xlogrecoveriunlinkbucket: 1. We don't null out previp after releasing it, which can lead to UAF problems if the inodegc flush call in...

SUSE CVE-2026-98444

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

SUSE CVE-2026-98446

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let hiddenspace go negative in xfsmetafileresvinit LOLLM points out that if the amount of fdblocks that we can reserve for a metadata btree file goes below the space already used by that file, then the hiddenspace...

SUSE CVE-2026-98447

In the Linux kernel, the following vulnerability has been resolved: xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots LOLLM noticed that the inode btree root formatting methods copy too many bytes -- there's only one set of keys in node blocks, not two. This causes memory...

SUSE CVE-2026-98448

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...

SUSE CVE-2026-98450

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

SUSE CVE-2026-98452

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

SUSE CVE-2026-98453

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

SUSE CVE-2026-98454

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...

SUSE CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

SUSE CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

SUSE CVE-2026-98458

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

SUSE CVE-2026-98459

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

SUSE CVE-2026-98460

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

SUSE CVE-2026-98461

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

SUSE CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

SUSE CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

SUSE CVE-2026-98468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

SUSE CVE-2026-98470

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

SUSE CVE-2026-98471

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

SUSE CVE-2026-98473

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

SUSE CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

SUSE CVE-2026-98475

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also a...

SUSE CVE-2026-98477

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task context is scheduled in on this CPU. perfpmuschedtask therefore always...

SUSE CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

SUSE CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

SUSE CVE-2026-98482

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

SUSE CVE-2026-98486

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

SUSE CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

SUSE CVE-2026-98493

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

SUSE CVE-2026-98495

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

SUSE CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

SUSE CVE-2026-98499

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

SUSE CVE-2026-98500

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

SUSE CVE-2026-98501

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

SUSE CVE-2026-98502

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alpsinputconfigured allocates a second input device "DualPoint Stick" with inputallocatedevice and registers it, but the alpsdriver struct has no .remove handler and...

SUSE CVE-2026-98503

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

SUSE CVE-2026-98504

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

SUSE CVE-2026-98507

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix missing barrier between anonvma init and vma-anonvma publish On arm64 server, we find that a task trying to grab the anonvma lock triggers hungtask. INFO: task main:2354726 blocked for more than 120 seconds. Tainted:...

SUSE CVE-2026-98510

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

SUSE CVE-2026-98511

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveaubopinlocked nouveaubopinlocked checks whether an already pinned BO is in a memory domain compatible with a new pin request. When the domains are incompatible, it sets...

SUSE CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...