SUSE CVE-2026-64021

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix execqueue leak on width check in stream open In xeoastreamopenioctl, when param.execq-width 1 the function returns -EOPNOTSUPP directly, skipping the existing errexecq cleanup path. The execqueue reference obtained...

SUSE CVE-2026-64022

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregator The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. Destroy it as the la...

SUSE CVE-2026-64023

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr-lookups-devid before removing the entry from the lookup table. If a concurrent thread calls gpiodfind before we remove the entry, it could iterate over the li...

SUSE CVE-2026-64024

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...

SUSE CVE-2026-64025

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

SUSE CVE-2026-64026

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

SUSE CVE-2026-64027

In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking again Recent commit changed the semantics from NOTVALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing ...

SUSE CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

SUSE CVE-2026-64029

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with eventinput sequmpprocessevent borrows client-outrfile.output without synchronizing with the first-open and last-close transition in sequmpclientopen and sequmpclientclose. The last...

SUSE CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check linkid in ieee80211mlepcs IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata-link has IEEE80211MLDMAXNUMLINKS 15...

SUSE CVE-2026-64031

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: Thread 1 Thread 2 zerofsfillbiovec ... filemapaddfolio 1 zerofsbindcache...

SUSE CVE-2026-64032

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables...

SUSE CVE-2026-64033

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created and srvpath-kobj may already have been initialized. If a later step...

SUSE CVE-2026-64034

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and bounds-checked, then manahwchandleresp re-reads the same field from the same DMA...

SUSE CVE-2026-64035

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

SUSE CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

SUSE CVE-2026-64037

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets maxtidamsdulen to the sentinel value 1. The TSO segmentation path in...

SUSE CVE-2026-64038

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

SUSE CVE-2026-64039

In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code where most of the regions are aligned, but fails for snapshotting of the DSI da...

SUSE CVE-2026-64040

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix error return when vfsmkdir fails When vfsmkdir fails, the error code is not extracted from the returned error pointer. This causes mkdirerror to be reached with ret=0, which leads to returning ERRPTR0 NULL instead...

SUSE CVE-2026-64041

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210xeffectsceneinfo, a string was copied like this: strscpyDST, SRC, strlenSRC + 1; A buffer overflow would happen if strlenSRC = sizeofDST. Actually, strscpy must be used...

SUSE CVE-2026-64042

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's...

SUSE CVE-2026-64043

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix race between deleting interface and adding new peer While deleting an existing ovpn interface, there is a very narrow window where adding a new peer via netlink may cause the netdevice to hang and prevent its...

SUSE CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

SUSE CVE-2026-64045

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

SUSE CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

SUSE CVE-2026-64047

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sgchain entry count for wrapped skmsg ring When an skmsg scatterlist ring wraps sg.end sg.datamsgpl-sg.start, MAXSKBFRAGS - msgpl-sg.start + 1, msgpl-sg.data; This places the chain pointer at...

SUSE CVE-2026-64048

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

SUSE CVE-2026-64050

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed becaus...

SUSE CVE-2026-64051

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remappfnrange during mmap The call to remappfnrange in qaicgemobjectmmap is susceptible to remapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap unmaps...

SUSE CVE-2026-64052

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in biointegritymapuser pinuserpagesfast can partially succeed and return the number of pages that were actually pinned. However, the biointegritymapuser does not handle this partial pinnin...

SUSE CVE-2026-64053

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bipvcnt in biointegritycopyuser biointegrityaddpage already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt = bipmaxvcnt on WRITE bipmaxvcnt is 1, so the gap-merge checks...

SUSE CVE-2026-64054

In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request netshapernlgroupdoit does not deduplicate NETSHAPERALEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in oldnodes. Th...

SUSE CVE-2026-64055

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmacrx NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx, but the packet is not y...

SUSE CVE-2026-64056

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

SUSE CVE-2026-64057

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afsgetlink The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: 1 It doesn't do any locking around afsreadsingle to prevent races between...

SUSE CVE-2026-64058

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio-private folio-private may get cleaned up by the...

SUSE CVE-2026-64059

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

SUSE CVE-2026-64060

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

SUSE CVE-2026-64061

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfsreadgaps Fix netfsreadgaps to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITERBVEC-class iterator is created that ha...

SUSE CVE-2026-64062

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

SUSE CVE-2026-64063

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing, netfslib will allow "streaming writes" in which dirty data is stored directly into folios without reading them first. Such folios are marked...

SUSE CVE-2026-64064

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

SUSE CVE-2026-64065

In the Linux kernel, the following vulnerability has been resolved: netfs: fix VMBUGONFOLIO issue in netfswritebegin call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sudo ./check generic/013 done...

SUSE CVE-2026-64066

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued subrequest fails...

SUSE CVE-2026-64067

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream-subrequests locklessly The list of subrequests attached to stream-subrequests is accessed without locks by netfscollectreadresults and netfscollectwriteresults, and then they acce...

SUSE CVE-2026-64068

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing locking around retry adding new subreqs Fix netfsretryreadsubrequests and netfsretrywritestream to take the appropriate lock when adding extra subrequests into stream-subrequests...

SUSE CVE-2026-64069

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream-subrequests list, it can't simply be put and abandoned...

SUSE CVE-2026-64070

In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show callbacks in hv-gpci take getcpuvarhvgpcireqb which calls preemptdisable but only call the matching putcpuvar on the error path under the 'out:' label...