SUSE CVE-2026-64519

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layout state revocation findonesbstid skips stids whose scstatus is non-zero, but the SCTYPELAYOUT case in nfsd4revokestates never sets scstatus before calling nfsd4closelayout. The retry loop therefore...

SUSE CVE-2026-64520

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Bound PARTITIONINFOGETREGS copies The register-based PARTITIONINFOGET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index...

SUSE CVE-2026-64521

In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs node may deadlock. pinconfpinsshow holds pctldev-mutex, and the platform driver calls pinctrlfindgpiorangefrompin, which tries to acquire the same...

SUSE CVE-2026-64522

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5exfrmaddstate handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label...

SUSE CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

SUSE CVE-2026-64524

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolutioncount and fix WIN8 fallback A SYNTHVIDRESOLUTIONRESPONSE with resolutioncount 64 walks past the supportedresolutionSYNTHVIDMAXRESOLUTIONCOUNT array in the parse loop. Bound resolutioncount against t...

SUSE CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

SUSE CVE-2026-64526

In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing ethnlopscomplete tsconfigpreparedata calls ethnlopsbegin, we need to call ethnlopscomplete before returning the error...

SUSE CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hypervreceivesub reads msg-vidhdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv-recvbuf. The completion...

SUSE CVE-2026-64528

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged 1. When console flow control is enabled UPFCONSFLOW, s3c24xxserialstoptx calls...

SUSE CVE-2026-64529

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qatadfctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public...

SUSE CVE-2024-53084

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Break an object reference loop When remaining resources are being cleaned up on driver close, outstanding VM mappings may result in resources being leaked, due to an object reference loop, as shown below, with ea...

SUSE CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

SUSE CVE-2026-64208

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

SUSE CVE-2026-64209

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...

SUSE CVE-2026-64210

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done...

SUSE CVE-2026-64211

In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcustruct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet...

SUSE CVE-2026-64212

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwlmldremovelink, the link-fwid is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is...

SUSE CVE-2026-64213

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Add lock protection to lm90alert Sashiko reports: lm90alert executes in the smbus alert context and calls lm90updateconfreg to disable the hardware alert line, without acquiring hwmonlock. Concurrently, sysfs write...

SUSE CVE-2026-64214

In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preemptdisable|enable calls from archirqworkraise A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at...

SUSE CVE-2026-64215

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

SUSE CVE-2026-64216

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfsunlockabandonedreadpages netfsunlockabandonedreadpagesrreq accesses the index of the folios it is wanting to unlock and compares that to rreq-nounlockfolio so that it doesn't unlock a folio being...

SUSE CVE-2026-64217

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfsextractuseriter Fix netfsextractuseriter so that if ioviterextractpages overfills pages, then those pages don't get included in the iterator constructed at the end of the function. If there was an...

SUSE CVE-2026-64218

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix reportwork leak on backbonegw purge batadvblapurgebackbonegw removes stale backbone gateway entries, but fails to properly handle their associated reportwork: - If reportwork is running, the purge must wait f...

SUSE CVE-2026-64219

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

SUSE CVE-2026-64220

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode-secondary to NULL in fwnodeinit If a firmware node is allocated on the stack for instance: temporary software node whose life-time we control or on the heap - but using a non-zeroing allocation functio...

SUSE CVE-2026-64221

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to...

SUSE CVE-2026-64222

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool-stack on AQ init failure otx2poolaqinit frees pool-stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2sqaurapoolinit unwinds the partial setup...

SUSE CVE-2026-64223

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211tidtolinkmapsizeok validates negotiated TTLM elements against the number of link-map entries indicated by linkmappresence. ieee80211parsenegttlm must consume the...

SUSE CVE-2026-64224

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free in rvureprsrcinit rvureprsrcinit allocates queue memory before calling otx2inithwresources. When hardware resource setup fails, otx2inithwresources already unwinds the partially initialized SQ, CQ, a...

SUSE CVE-2026-64225

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds check to cgxspeedmbps index cgxspeedmbps has 13 elements but RESPLINKSTATSPEED can yield values 0-15. If it returns a value = 13, this causes an out-of-bounds array access. Add a bounds check and...

SUSE CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

SUSE CVE-2026-64227

In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPICOMPANION against NULL during probe Since every platform driver can be forced to match a device that doesn't match its list of device IDs because of devicematchdriveroverride, platform drivers that rely on...

SUSE CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

SUSE CVE-2026-64229

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X86FEATUREPCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled. There are...

SUSE CVE-2026-64230

In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...

SUSE CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

SUSE CVE-2026-64232

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

SUSE CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

SUSE CVE-2026-64234

In the Linux kernel, the following vulnerability has been resolved: tty: serial: pchuart: add check for dmaalloccoherent Add a check for dmaalloccoherent failure to prevent a potential NULL pointer dereference in dmahandlerx. Properly release DMA channels and the PCI device reference using a goto...

SUSE CVE-2026-64235

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIGCALLDEPTHTRACKING enabled on an x86 retbleed-affected platform eg: Skylake, with retbleed=stuff, registering a dynamic ftrace trampoline crashes on...

SUSE CVE-2026-64236

In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by zero on missing clock-frequency When the 'clock-frequency' property is missing from the device tree, the driver falls back to DAVINCII2CDEFAULTBUSFREQ. However, this macro was defined in kHz 100,...

SUSE CVE-2026-64237

In the Linux kernel, the following vulnerability has been resolved: Input: elani2c - validate firmware size before use Ensure that the firmware file is large enough to contain the expected number of pages and the signature which resides at the end of the firmware blob before accessing them to...

SUSE CVE-2026-64238

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on shared proxy's parent removal Commit 710abda58055 "gpio: shared: call gpiochip::ofxlate if set" used the mutex embedded in struct gpiosharedentry to protect the offset field which now can be modified...

SUSE CVE-2026-64239

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete tried region in regionsrmdirs DAMON sysfs maintains the DAMOS tried region directory objects via a linked list. When the user requests refresh of the directories, DAMON sysfs removes all the region...

SUSE CVE-2026-64240

In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f "media: rc: igorplugusb: heed coherency rules" changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA...

SUSE CVE-2026-64241

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...

SUSE CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

SUSE CVE-2026-64243

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simplemuxcontrolput rejects values greater than e-items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so valu...

SUSE CVE-2026-64244

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem-altmap after successful device registration If addmemoryblock fails at xastore under memory pressure for example, deviceunregister is called, which eventually triggers memoryblockrelease with mem-altm...