SUSE CVE-2026-89524

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets ath6klcfg80211connectevent subtracts fixed IE offsets from assocreqlen -= 4 and assocresplen -= 6, both u8, with no lower bound. The aggregate check...

SUSE CVE-2026-89525

In the Linux kernel, the following vulnerability has been resolved: udf: reject VAT indexes equal to the entry count UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. snumentries stores the number of entries in that array, not the highest valid index. The val...

SUSE CVE-2026-89526

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Validate Read chunk positions before reconstruction The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. xdrcountreadsegments checks only 4-byte alignment;...

SUSE CVE-2026-89528

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Read lists that exceed the page budget Individual Read segment lengths are validated at decode time, but nothing prevents a requester from sending multiple segments whose cumulative length exceeds the rqpages arra...

SUSE CVE-2026-89529

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject oversized Read segments at decode time The RPC/RDMA Read list decoder stores wire-supplied segment lengths without validation. xdrcountreadsegments checks 4-byte alignment for non-zero position values but does not...

SUSE CVE-2026-89530

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inline replies that overflow the pull-up buffer An RPC-over-RDMA client can request a reply, such as an NFS READ payload, without providing a Write list or a Reply chunk to carry it. When such a reply needs more...

SUSE CVE-2026-89532

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix pclforeachsegment for empty chunks When a parsed chunk list contains a chunk whose chsegcount is zero, pclforeachsegment computes its inclusive upper bound as &chunk-chsegmentschsegcount - 1. chsegcount is u32, so th...

SUSE CVE-2026-89534

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Clear sccmid when ADDRCHANGE replacement fails When svcrdmalistenhandler handles RDMACMEVENTADDRCHANGE, it creates a replacement listener cmid and returns 1, telling the CM core to destroy the old one. If the replacement...

SUSE CVE-2026-89535

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reorder rpcrdmarnunregister before rdmadestroyid svcrdmafree caches rdma-sccmid-device before teardown, then calls rdmadestroyidsccmid which frees the cmid. rpcrdmarnunregister follows, but between those two calls the...

SUSE CVE-2026-89536

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

SUSE CVE-2026-89537

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short RFC 4121 MIC tokens in gsskrb5verifymicv2 gsskrb5verifymicv2 reads the token ID at ptr0..1, the flags byte at ptr2, and padding at ptr3..7, then passes ptr + GSSKRB5TOKHDRLEN and cksumlen to gsskrb5micbuildsg...

SUSE CVE-2026-89538

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field gsskrb5unwrapv2 sets buf-len to a logical length, which can be much smaller than head0.iovlen the allocated receive-page capacity. It then calls xdrbuftrim with a trim...

SUSE CVE-2026-89539

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

SUSE CVE-2026-89540

In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssplock before publishing proc entry createusegssproxyprocentry publishes /proc/net/rpc/use-gss-proxy via proccreatedata before initgsspclnt runs mutexinit on sn-gssplock. Once the dentry is linked under...

SUSE CVE-2026-89542

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gsskrb5unwrapv2 against short tokens gsskrb5unwrapv2 reads the EC and RRC header fields at ptr+4 and ptr+6 before validating that the token is at least GSSKRB5TOKHDRLEN 16 bytes long, and its rotateleft helper pass...

SUSE CVE-2026-89543

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in rpcclnthandleevent and rpcclntremovepipedir Normal client creation goes through rpcsetuppipedir, which records clnt-pipefssb, but the mount-event path in rpcclnthandleevent calls rpcsetuppipedirsb...

SUSE CVE-2026-89544

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssxdecoptionarray error path bugs Four coupled defects in the gssx XDR option-array decoder make the error paths unsafe: a NULL deref in the caller, a refcount leak on the decoded groupinfo, and a latent use-after-fr...

SUSE CVE-2026-89547

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation svccreate initializes three per-pool percpucounter stats and ignores every return value. On SMP, percpucounterinit fails when allocpercpugfp cannot satisfy the allocation, leaving...

SUSE CVE-2026-89548

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cachecleaner before destroying a cachedetail sunrpcdestroycachedetail only cancels the global cachecleaner delayedwork when cachelist is empty. During per-netns teardown cachelist is never empty because...

SUSE CVE-2026-89550

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauthgss: enforce krb5 token minimum length svcauthgssunwrappriv validates only an upper bound on the wire-supplied opaque length before handing the buffer to gssunwrap: if len xdrstreamremainingxdr goto unwrapfailed;...

SUSE CVE-2026-89553

In the Linux kernel, the following vulnerability has been resolved: nouveau/gem: reserve the bo in the info ioctl around the vma lookup In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted...

SUSE CVE-2026-89556

In the Linux kernel, the following vulnerability has been resolved: module: validate string table section types In elfvaliditycachesechdrs, section sizes and offsets are validated, unless the section type is SHTNULL or SHTNOBITS. Later, elfvaliditycachesecstrings and elfvaliditycacheindexstr acce...

SUSE CVE-2026-89558

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix stilldegraded being inverted in raid10syncrequest Commit fe6a19d40ceb "md/md-bitmap: merge mdbitmapstartsync into bitmapoperations" converted stilldegraded from int to bool, but inverted the assignment in the loop...

SUSE CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

SUSE CVE-2026-89561

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix NULL dereference of idev in ipv6rplsrhrcv ipv6rplsrhrcv dereferences idev from in6devget without a NULL check when reading idev-cnf.rplsegenabled. When the device's MTU drops below IPV6MINMTU, addrconfifdown clears...

SUSE CVE-2026-89562

In the Linux kernel, the following vulnerability has been resolved: ip6gre: fix hardware header length for NBMA tunnels ip6gretnllinkconfigroute accumulates the lower device's hardware header length into dev-hardheaderlen whenever headerops is set. This is incorrect for both users of headerops...

SUSE CVE-2026-89563

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

SUSE CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv returns 0 without freeing the skb when iptunrxdst fails to allocate the metadatadst. ipiprcv and mplsiprcv are registered as...

SUSE CVE-2026-89567

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nrtoscan. Busy buffers therefore do not consume the scan budget. If a...

SUSE CVE-2026-89571

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...

SUSE CVE-2026-89573

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's arrayblockcheck can only compare the header against itself, so a block with valuesize 4 and maxentries 1018 is internally consistent and passes. dm-cache keeps...

SUSE CVE-2026-89575

In the Linux kernel, the following vulnerability has been resolved: dm raid1: reserve space for NUL-terminator in buildconstructorstring Reserve space for the termination NUL after the maximum 20 decimal digits of a long long value to avoid buffer overflow in sprintf...

SUSE CVE-2026-89577

In the Linux kernel, the following vulnerability has been resolved: dm-io: report non-retryable errors separatedly The error codes BLKSTSNOTSUPP and BLKSTSINVAL should not cause leg failure on dm-raid1. This patch changes the interface to dm-io, so that it reports two error bitmaps - errorbits an...

SUSE CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

SUSE CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

SUSE CVE-2026-89583

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix OOB read in eirgetservicedata eirgetservicedata walks the advertising data for a Service Data field with a matching UUID. On a mismatch it advances: eir += dlen; eirlen -= dlen; eirgetdata reports dlen as the...

SUSE CVE-2026-89584

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

SUSE CVE-2026-89586

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes atascsiwritesamexlat translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by...

SUSE CVE-2026-89589

In the Linux kernel, the following vulnerability has been resolved: acpi/apei/ghes: Use rawspinlockt for CXL CPER work locks The CXL CPER work registration and unregistration helpers acquire cxlcperworklock and cxlcperproterrworklock with a spinlock guard, which leaves local interrupts enabled. T...

SUSE CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

SUSE CVE-2026-89593

In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, th...

SUSE CVE-2026-89595

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...

SUSE CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

SUSE CVE-2026-89598

In the Linux kernel, the following vulnerability has been resolved: fbdev: ssd1307fb: defer I2C transfers from damage callbacks The fbdev damage callbacks may run from fbcon while printk has disabled preemption. They currently update the display synchronously, which enters the sleeping I2C transf...

SUSE CVE-2026-89599

In the Linux kernel, the following vulnerability has been resolved: fbdev: omapfb: panel-dsi-cm: initialize lock before registering display dsicmprobe registers the display before initializing ddata-lock. Once omapdssregisterdisplay publishes the display, another consumer can reach a dsicm callba...

SUSE CVE-2026-89600

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix use-after-free of file range info fsnotifyprecontent builds its filerange on the triggering task's stack. fanotifyallocpermevent saves a pointer to range.pos in the heap-allocated permission event so...

SUSE CVE-2026-89602

In the Linux kernel, the following vulnerability has been resolved: erofs: skip sufficiently large global buffers when resizing zerofsgbufnrpages is advanced only after every global buffer has been grown. If a resize fails after some buffers were enlarged, a retry revisits those enlarged buffers...

SUSE CVE-2026-89603

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

SUSE CVE-2026-89604

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Rate limit statfs handler Ravi reports that statfs may be called by unprivileged users on the efivarfs mount point, which may result in a flood of calls to the QueryVariableInfo runtime service. These calls are...

SUSE CVE-2026-89605

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: release message context on send failure ecryptfssendmessagelocked moves a message context from the free list to the allocated list before sending the request to the userspace daemon. If ecryptfssendmiscdev fails, the...