SUSE CVE-2026-53371

In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: bound nodedesc sysfs read with %.64s nodedesc64 in struct ibdevice is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason drivers/infiniband/core/sysfs.c:1307, since...

SUSE CVE-2026-53372

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Block PASID attachment to nested domain with dirty tracking Kernel lacks dirty tracking support on nested domain attached to PASID, fails the attachment early if nesting parent domain is dirty tracking configured,...

SUSE CVE-2026-53381

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput called from fusereleaseend can Oops if the super block has already been destroyed. Normally this is prevented by waiting for numwaiting to go down to zero before commencing with super blo...

SUSE CVE-2026-53382

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can return NULL, but vidtvmuxpushsi does not check for this before dereferenci...

SUSE CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...

SUSE CVE-2026-53384

In the Linux kernel, the following vulnerability has been resolved: serial: 8250dw: unregister 8250 port if clknotifierregister fails dw8250probe registers the 8250 port via serial8250register8250port and then, if the device has a clock, registers a clock notifier. If clknotifierregister fails,...

SUSE CVE-2026-53385

In the Linux kernel, the following vulnerability has been resolved: vcscreen: fix null-ptr-deref in vcsnotifier during concurrent vcswrite A KASAN null-ptr-deref was observed in vcsnotifier: BUG: KASAN: null-ptr-deref in vcsnotifier+0x98/0x130 Read of size 2 at addr qmpcmdname: qmpcapabilities,...

SUSE CVE-2026-53386

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pgasettings index ads1298pgasettings has 7 elements but ADS1298MASKCHPGA can yield values 0-7. If it yields a value = 7, this causes an out-of-bounds array access. Add a bounds check and...

SUSE CVE-2026-53387

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075itms index veml6075itms has 5 elements but VEML6075CONFIT can yield values 0-7. If it returns a value = 5, this causes an out-of-bounds array access. Add a bounds check and return...

SUSE CVE-2026-53388

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fusetrymovefolio unlocks the request on entry but does not re-lock it on the success path. This means fusechanabort can end the request and free the fuseioargs eg...

SUSE CVE-2026-53389

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN...

SUSE CVE-2026-53390

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smbcheckpermdacl The permission-check ACE walk in smbcheckpermdacl validates the ACE header size and caps sid.numsubauth at SIDMAXSUBAUTHORITIES, but it never checks that ace-size is actually larg...

SUSE CVE-2026-53391

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length raddr in nfs4decodempdsaddr nfs4decodempdsaddr decodes the rnetid and raddr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchrbuf, '.' to locate the port...

SUSE CVE-2026-53392

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count fflayoutalloclseg decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzallocobjs, and the current code only rejects...

SUSE CVE-2026-53394

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When findorallocopenstateowner encounters an unconfirmed owner, it calls releaseopenowner and sets oo = NULL. Control then falls through past the if oo guard -...

SUSE CVE-2026-53395

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4create nfsd4create steals create-crdpacl/crpacl into the local nfsdattrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard...

SUSE CVE-2026-53396

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak and ignored error in nfsd4createfile nfsd4createfile has two bugs in its ACL handling: The return value of nfsd4acltoattr is silently discarded. When the NFSv4-to-POSIX ACL conversion fails e.g., -EINVAL f...

SUSE CVE-2026-53397

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posixacl leak on SETACL decode failure nfsaclsvcdecodesetaclargs and nfs3svcdecodesetaclargs each call nfsstreamdecodeacl twice, first for NFSACL and then for NFSDFACL. Each successful call transfers ownership of a...

SUSE CVE-2026-53398

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFONONAME decode error cleanup nfsd4decodesecinfononame currently initializes sinexp after decoding sinstyle. If the XDR stream is truncated, the decoder returns nfserrbadxdr before sinexp is initialized. Since comm...

SUSE CVE-2026-53399

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When nfsd4layoutsetlease then fails, the error pat...

SUSE CVE-2026-53400

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

SUSE CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

SUSE CVE-2026-53402

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in errout of fbcondosetfont When fbcondosetfont fails e.g., due to a memory allocation failure inside vcresize under heavy memory pressure, it jumps to the errout label to roll back the consol...

SUSE CVE-2026-53403

In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fbnewmodelist to prevent null-ptr-deref in fbvideomodetovar info-var, a framebuffer's current mode, is expected to have a matching entry in info-modelist. vartodisplay relies on this and treats a failed fbmatchmode as...

SUSE CVE-2026-53583

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD...

SUSE CVE-2026-53584

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

SUSE CVE-2026-53585

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

SUSE CVE-2026-53586

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, an...

SUSE CVE-2026-53587

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in setdata in src/libgit2/transports/smartpkt.c without first...

SUSE CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

SUSE CVE-2026-59678

An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager. This issue affects PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe...

SUSE CVE-2026-63793

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol-volumelabel with a mutex and snaphost the label before copytouser. This prevent a use-after-free when FSIOCSETFSLABEL replaces the vol-volumelabel and FSIOCGETTSLABEL reads it...

SUSE CVE-2026-63794

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

SUSE CVE-2026-63795

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

SUSE CVE-2026-63796

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2validategdparent only bounds bgbits against the parent allocator's chain geometry. A malicious descriptor can still claim a bgsize/bgbits pair that exceeds the bitmap bytes th...

SUSE CVE-2026-63797

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

SUSE CVE-2026-63798

In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers using...

SUSE CVE-2026-63799

In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clearbit when CID is MMCIDUNSET in fixup path In mmcidfixupcpustotasks, when rq-curr has the target mm and mmcid.active is set, the CID is checked with cidintransit before setting the transition bit. In per-C...

SUSE CVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

SUSE CVE-2026-63801

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipcaeaddecryptdone tipcaeaddecrypt goes straight from tipcbearerholdb to cryptoaeaddecryptreq without taking a reference on the netns, unlike the encrypt path. When cryptoaeaddecrypt is...

SUSE CVE-2026-63802

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in blkcgrstatflush When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's blkcgrstatflush removes another blkg's iostat entries via...

SUSE CVE-2026-63803

In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6CP embedded in struct ppp registers a timer via timersetup. That struct ppp is the hdlc-state allocation, which detachhdlcprotocol...

SUSE CVE-2026-63804

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2qddealloc gfs2qddealloc, called as an RCU callback from gfs2qddispose, accesses the superblock object sdp through qd-qdsbd after freeing qd. It does so to decrement sdquotacount and wake up...

SUSE CVE-2026-63805

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nxcryptoctxexit argument nxcryptoctxshashexit calls nxcryptoctxexit with cryptoshashctx... but cryptoshashctx gives a nxcryptoctx , not a cryptotfm . Fix the type in nxcryptoctxexit and drop the bogus cryptotfmct...

SUSE CVE-2026-63806

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUGON in ioeventfd datamatch with getunaligned Drop a BUGON that has been reachable since it was first added, way back in 2009, and instead use getunaligned to perform potentially-unaligned accesses...

SUSE CVE-2026-63807

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, before queryi...

SUSE CVE-2026-63808

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfatfinddirentry In exfatfinddirentry, the bufferhead obtained from exfatgetdentry is released with brelsebh before the fall-through TYPEEXTEND branch reads the directory entry through ep...

SUSE CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

SUSE CVE-2026-63810

In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it...

SUSE CVE-2026-63811

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back from the COW inode: prepareatomicwritebegin locates the block in the COW...