SUSE CVE-2026-64429

In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use rawspinlockt in the irq startup path sprdeicirqunmask enables the GPIO IRQ and then updates controller state through sprdeicupdate, which takes sprdeic-lock with spinlockirqsave. The callback can be reached fr...

SUSE CVE-2026-64430

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

SUSE CVE-2026-64431

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

SUSE CVE-2026-64432

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

SUSE CVE-2026-64433

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete adddevicecomplete runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup and then dereferences the...

SUSE CVE-2026-64434

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2capchantimeout runs asynchronously and accesses chan-conn. If the connection is torn down while the timer is running or pending, chan-conn can be freed, leading t...

SUSE CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue - skbunlin...

SUSE CVE-2026-64436

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

SUSE CVE-2026-64437

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 "ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL" made smb2cancel skip a work whose state is...

SUSE CVE-2026-64438

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

SUSE CVE-2026-64439

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

SUSE CVE-2026-64440

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HTcapshandler HTcapshandler iterates pIE-length bytes and writes into HTcaps.u.HTcap, which is a fixed 26-byte array sizeof struct HTcapselement. Because pIE-length is a raw u8 from an...

SUSE CVE-2026-64441

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtwgetsecie, rtwgetwapiie, and rtwgetwpsattr Three IE/attribute parsing functions have missing bounds checks. rtwgetsecie and rtwgetwapiie iterate over a raw IE buffer without verifying that t...

SUSE CVE-2026-64442

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

SUSE CVE-2026-64443

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

SUSE CVE-2026-64444

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

SUSE CVE-2026-64445

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth OnAuth has two bugs in the shared-key authentication path. When the Privacy bit is set, rtwwepdecrypt is called without verifying that the frame is long enough t...

SUSE CVE-2026-64446

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtwcfg80211setwpaie supplicantie is a 256-byte array in struct securitypriv. The WPA and WPA2 IE copy paths use: memcpypadapter-securitypriv.supplicantie, &pwpa0, wpaielen + 2; wher...

SUSE CVE-2026-64447

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

SUSE CVE-2026-64448

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc0 exemption to responses without data area smb2checkmessage has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received "server ca...

SUSE CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser and bufferfromuser copy 'count' bytes into/out of the fixed-size kernbuf sizebuf == PCIBUFSIZE == 0x20000, 128 KiB using ppos as the...

SUSE CVE-2026-64450

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

SUSE CVE-2026-64451

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

SUSE CVE-2026-64452

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC descriptor while holding lowpannhclock. If the descriptor has no uncompress callback, the error path drops the lock before printing...

SUSE CVE-2026-64453

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbiodisconnect walks usbio-clilist in reverse and uninitializes each auxiliary device. auxiliarydeviceuninit drops the device reference, and for an unbound child that can r...

SUSE CVE-2026-64454

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3gadgetsuspend takes dwc-lock with IRQs disabled and then calls dwc3disconnectgadget. For async callbacks that helper only uses plain spinunlock/spinlock, so the...

SUSE CVE-2026-64455

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

SUSE CVE-2026-64456

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copydata randomrecvdone stores the device-reported used.len directly into vi-dataavail. copydata then indexes vi-data using vi-dataidx advanced by previous copydata calls and issue...

SUSE CVE-2026-64457

In the Linux kernel, the following vulnerability has been resolved: virtiopci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 /sys/bus/virtio/drivers/virtioballoon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer...

SUSE CVE-2026-64458

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damonhotscore Fix three issues in damonhotscore that comes from wrong handling of extreme zero or too high monitoring intervals user setup. When the user sets sampling interval zer...

SUSE CVE-2026-64459

In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcpaodestroysock Commit 51e547e8c89c "tcp: Free TCP-AO/TCP-MD5 info/keys without RCU" removed the callrcu callback from tcpaodestroysock, arguing that "the destruction of info/keys is delayed unti...

SUSE CVE-2026-64460

In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriovrestorevfrebarstate uses the VF Resizable BAR Control register to decide how many VF BARs to restore nbars and which VF BAR each iteration addresses baridx. baridx indexes...

SUSE CVE-2026-64461

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtkpcieenableport fails, mtkpcieportfree removes the port from pcie-ports and frees the port structure. However, the IRQ domains set up earlier by...

SUSE CVE-2026-64462

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove. If pcihostprobe fails, the handler and INTx IRQ domain remain set even though the...

SUSE CVE-2026-64463

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpcirt1711h: unregister TCPCI port with devres rt1711hprobe registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns...

SUSE CVE-2026-64464

In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhciringtosgtable allocates a temporary pages array and uses it to build the returned sgtable with sgalloctablefrompages. The error paths free the pages array, but the success path...

SUSE CVE-2026-64465

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhcifreestreams When a USB device with active stream endpoints is disconnected, xhcifreestreams is called from the hubevent workqueue to free the stream resources. It calls...

SUSE CVE-2026-64466

In the Linux kernel, the following vulnerability has been resolved: rustbinder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this...

SUSE CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

SUSE CVE-2026-64468

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderfreetransaction In binderfreetransaction, the t-toproc is read under the t-lock. However, once the t-lock is dropped, the toproc can die in parallel. This leads to a use-after-free error when we attempt t...

SUSE CVE-2026-64469

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderthreadrelease When a thread exits, binderthreadrelease walks its transaction stack to clear the t-from and t-toproc that correspond with the exiting thread. However, a process dying in parallel might...

SUSE CVE-2026-64470

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue...

SUSE CVE-2026-64471

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This...

SUSE CVE-2026-64472

In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently updated into the same...

SUSE CVE-2026-64473

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfscreatedevmseqfile store a devres allocated debugfsdevmentry as inode private data. vfiounregistergroupdev currently calls...

SUSE CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

SUSE CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

SUSE CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

SUSE CVE-2026-64477

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

SUSE CVE-2026-64478

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...