SUSE CVE-2026-68187

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transferargstostack The stop value is derived from bprm-p PAGESHIFT. The index variable is an unsigned long. If bprm-p drops below PAGESIZE and stop becomes zero the loop condition index =...

SUSE CVE-2026-68202

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queuedelete closes the queue timer, then frees it. sndseqtimerclose clears q-timer-timeri. snduselocksync then drains borrowers, and sndseqtimerdelete frees q-timer. A...

SUSE CVE-2026-68253

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: check streams bounds before overflow The data-streams overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a...

SUSE CVE-2026-71847

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...

SUSE CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

SUSE CVE-2026-72814

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

SUSE CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

SUSE CVE-2026-73514

The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...

SUSE CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

SUSE CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

SUSE CVE-2026-68254

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered by coincidence through the checks in intelvrriscapable and intelvrrisinrange, but be more...

SUSE CVE-2026-68255

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the response buffer virtiogetedidblock validates the read offset only against the device-supplied resp-size field, never against the fixed-size resp-edid array. The EDID block index is driven...

SUSE CVE-2026-68256

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function entry, but the DP alt mode timeout path inside SIGNALTYPEDISPLAYPORT...

SUSE CVE-2026-68260

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

SUSE CVE-2026-68261

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: fix error checking of pvrvmcontextlookup Since pvrvmcontextlookup returns either NULL or a pointer, then stop using ISERR for checking the return value. Using ISERR leads to the kernel oops reported below. It can...

SUSE CVE-2026-68262

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix user array stride in pvrsetuobjarray pvrsetuobjarray copies an array of kernel objects to a userspace array whose element size is described by out-stride. When out-stride is different from the kernel object...

SUSE CVE-2026-68263

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix double call to drmschedentityfini Call sequence of double call: pvrcontextdestroy pvrcontextkillqueues pvrqueuekill drmschedentitydestroy drmschedentityfini // here pvrcontextput...

SUSE CVE-2026-68264

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...

SUSE CVE-2026-68265

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

SUSE CVE-2026-68266

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttmbotypesg BO whose reservation object is the exporter's dmabuf-resv. The importer, however, only takes a dma-buf reference after a...

SUSE CVE-2026-68267

In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RINGFORCETONONPRIVDENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RINGFORCETONONPRIVDENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default...

SUSE CVE-2026-68268

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...

SUSE CVE-2026-68269

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Add missing nospec on parallel submit slot Add missing Spectre mitigation for userspace controlled parallel submission slot. Discovered using AI-assisted static analysis confirmed by Intel Product Security. cherry...

SUSE CVE-2026-68270

In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Avoid possible truncation with calculating visible size Calculating the visible size of the system framebuffer can result in truncation of the result. The calculation uses 32-bit arithmetics, which can overflow if the...

SUSE CVE-2026-68271

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix reversed error cleanup order in ucopy functions nouveauuvmmvmbinducopy and nouveauexecucopy place their error cleanup labels in allocation order rather than reverse allocation order. On a umemcpya failure for...

SUSE CVE-2026-68272

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1 Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1, matching the gate already present for the IB, FENCE and BOHANDLES chunk types. The...

SUSE CVE-2026-68273

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferences at context initialization time. Bot...

SUSE CVE-2026-68274

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

SUSE CVE-2026-68275

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

SUSE CVE-2026-68276

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...

SUSE CVE-2026-68277

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

SUSE CVE-2026-68292

In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf-txtimetxqs bitmap tracks which Tx queues have ETF Earliest TxTime First offload enabled. This bitmap is indexed by queue number and is set by iceoffloadtxtime, which...

SUSE CVE-2026-68293

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIA register can return up to 32 dwords 128 bytes when the device advertises the mcia32dwords capability, but struct mlx5ifcmciaregbits only defines dword0..11,...

SUSE CVE-2026-68294

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtrlocalnid is a single global node id...

SUSE CVE-2026-68295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPFDIV and BPFMOD...

SUSE CVE-2026-68296

In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before commit 00d066a4d4ed "netdevfeatures: convert NETIFFLLTX to dev-lltx", NETIFFLLTX was set unconditionally in both gretunnelinit and ip6gretnlinitfeatures alongside...

SUSE CVE-2026-68297

In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TIPCNLMEDIASET and TIPCNLBEARERSET accept user-supplied MTU values but only enforce a minimum bound, not a maximum. When a user sets the MTU to a value exceedin...

SUSE CVE-2026-68298

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xevmcreate Commit 9e9787414882 "drm/xe/userptr: replace xehmm with gpusvm" made xesvminit unconditional in xevmcreate and extended it to also initialize a "simple" gpusvm state...

SUSE CVE-2026-68299

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: fix BUGON in vmxnet3gethdrlen for Geneve packets vmxnet3gethdrlen assumes gdesc-rcd.v4/v6/tcp always describe the outer header, but for a Geneve-encapsulated packet the device can set them based on the inner header...

SUSE CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

SUSE CVE-2026-68301

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

SUSE CVE-2026-68302

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr or the AMT message header and then call a helper that can reallocate that head befo...

SUSE CVE-2026-68303

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hvs/v3d: Fix null dereference in unbind The hvs and v3d drivers use devgetdrvdatamaster in their unbind functions. Since the vc4-drm gets removed before its dependent drivers vc4hvs/vc4v3d the vc4hvsunbind/vc4v3dunbind...

SUSE CVE-2026-68304

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix 802.1X-SHA256 call trace warning Based on wpaauth as 1x256 mode, need to set up "usefwsup" with BRCMFPROFILEFWSUP1X. Or it will happen trace warning when call brcmfcfg80211setpmk. 4481.831101 ------------ cut...

SUSE CVE-2026-68305

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Add drmdev guards when detaching CCS read/write buffers CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid,...

SUSE CVE-2026-68306

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996mcustabfereht mt76connacgetehtphycap routine can theoretically return NULL so check cap pointer before dereferencing it...

SUSE CVE-2026-68307

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix crash in reset link replay During reset recovery, mt7925vifconnectiter replays firmware state for links tracked in mvif-validlinks. After MLO link changes or MCU timeout recovery, the driver bitmap can...

SUSE CVE-2026-68308

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

SUSE CVE-2026-68309

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

SUSE CVE-2026-68360

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Stop device IO before calling hidhwstop Calling hidhwstop does not stop the device IO. This results in a race condition between hidinputreport and the point immediately following the execution of...