SUSE CVE-2026-70906

unknown...

SUSE CVE-2026-70907

unknown...

SUSE CVE-2026-72185

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix WARNON for resident attribute in ntfsmaprunlistnolock When ntfsmaprunlistnolock needs to look up the attribute extent containing a target VCN ctxneedsreset == true, it calls ntfsattrlookup and then expects the result to...

SUSE CVE-2026-72186

In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap is exposed via showsysfiles and written from userspace, the volume is corrupted and, because the cluster allocator scans $Bitmap through t...

SUSE CVE-2026-72188

In the Linux kernel, the following vulnerability has been resolved: ntfs: sanitize MFT references returned from ntfslookupinodebyname ntfslookupinodebyname returns MFT references read from directory index entries on disk. These values are untrusted, but the function can currently return an...

SUSE CVE-2026-72191

In the Linux kernel, the following vulnerability has been resolved: ntfs3: validate split-point offset in indxinsertintobuffer indxinsertintobuffer computes used = used1 - tocopy - spsize; memmovedet, Add2Ptrsp, spsize, used - le32tocpuhdr1-deoff; where sp and spsize come from hdrfindsplit...

SUSE CVE-2026-72192

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound tomove in indxinsertintoroot before hdrinserthead indxinsertintoroot promotes a full resident $INDEXROOT into $INDEXALLOCATION and copies all non-last resident root entries into a newly allocated INDEXBUFFER via...

SUSE CVE-2026-72194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS image with circular index node references causes unbounded recursion,...

SUSE CVE-2026-72198

In the Linux kernel, the following vulnerability has been resolved: ntfs: reject non-resident records for resident-only attributes The shared lookup-time attribute validator rejects non-resident $FILENAME and $VOLUMENAME records because their formats require resident values and callers handle...

SUSE CVE-2026-72199

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate resident index root values on lookup Resident $INDEXROOT values carry index header fields that callers consume after lookup. Some callers already validate parts of the layout before walking entries, but those check...

SUSE CVE-2026-72200

In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlis...

SUSE CVE-2026-72201

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index entries on reading Validate index entries immediately after reading an index root or index block from disk. This eliminates repeated checks in lookup and readdir, and reduce the risk of missing checks in thos...

SUSE CVE-2026-72203

In the Linux kernel, the following vulnerability has been resolved: ntfs: skip extent mft records in writeback to prevent deadlock This patch fixes the ABBA deadlock between extentlock and extent mreclock triggered by xfstests generic/113, that occurs since the commit 6994acf33bae "ntfs: use base...

SUSE CVE-2026-72206

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate index block header more strictly Modify ntfsindexblockinconsisent to perform stricter validation of INDEXHEADER geometry in INDX blocks, and update ntfslookupinodebyname to use that function to validate INDX blocks...

SUSE CVE-2026-72207

In the Linux kernel, the following vulnerability has been resolved: ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other resident attributes to non-resident to free space in the MFT recrord...

SUSE CVE-2026-72208

In the Linux kernel, the following vulnerability has been resolved: ntfs: add bounds check before accessing EA entries in ntfsealookup and ntfslistxattr, this verifies that there is enough space in the EA entry before accessing the nextentryoffset field of the EA entry...

SUSE CVE-2026-72209

In the Linux kernel, the following vulnerability has been resolved: ntfs: validate attribute values on lookup ntfsattrfind and ntfsexternalattrfind check that generic resident attribute values fit in their attribute records and that fixed-size resident values are large enough. For variable-length...

SUSE CVE-2026-72210

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one in mapping pairs decoding bounds checks In ntfsmappingpairsdecompress, attrend points one byte past the end of the attribute record: attrend = u8 attr + le32tocpuattr-length; The two bounds checks validating...

SUSE CVE-2026-72211

In the Linux kernel, the following vulnerability has been resolved: ntfs: grow index root value before reparent header update ntfsirreparent moves the resident index root entries into an index block and leaves a small root stub containing the child VCN. That root stub can be larger than the...

SUSE CVE-2026-72217

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Bound-check xdrbuftobvec stores before writing xdrbuftobvec writes a biovec into the caller's array before testing whether that slot is in range, and the head branch performs the store with no check at all. When the...

SUSE CVE-2026-72220

In the Linux kernel, the following vulnerability has been resolved: sunrpc: harden rqprocinfo lifecycle to prevent double-free The svcreleaserqst function executes the callback inside rqstp-rqprocinfo-pcrelease. However, if a worker thread begins processing a new request and encounters an early...

SUSE CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

SUSE CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

SUSE CVE-2026-72226

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: prevent TVLV OOB check overflow A TT unicast TVLV contains the number of VLANs stored in it. This number is an u16 and gets multiplied by the size of the struct batadvtvlvttvlandata 8 bytes. The size can therefore...

SUSE CVE-2026-72234

In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicastttvn skb-data only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

SUSE CVE-2026-72239

In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSRAMD64SYSCFGSNPEN" Revert 99cf1fb58e68 "x86/virt/sev: Drop WBINVD before setting MSRAMD64SYSCFGSNPEN". Section 8.8 of the SNP spec says: Before invoking SNPINITEX with INITRMP se...

SUSE CVE-2026-72248

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...

SUSE CVE-2026-72249

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...

SUSE CVE-2026-72251

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

SUSE CVE-2026-72277

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the...

SUSE CVE-2026-72278

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLLWRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gues...

SUSE CVE-2026-72279

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backi...

SUSE CVE-2026-72288

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling Hyunwoo Kim reports some really bad races should the following situation occur: - LPI-I is pending in vcpu-B's AP list - vcpu-A writes to vcpu-B's ...

SUSE CVE-2026-72289

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgicpruneaplist drops both aplistlock and irqlock while migrating an interrupt to another vCPU. After reacquiring the locks it only checks that the affinity ...

SUSE CVE-2026-72889

Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signaturemethod parameter of the incoming message. signaturemethod is required on every request, so the algorithm used to check a signature is...

SUSE CVE-2026-73067

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::readsquisheddawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls numforwardedges0 and lastedge in...

SUSE CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

SUSE CVE-2026-73566

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname and no segment cap when tar.t... or tar.x... receives a non-empty member-selection list. A...

SUSE CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

SUSE CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

SUSE CVE-2026-73621

GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count method, which forwards keyword arguments to 'git rev-list' without the checkunsafeoptions guard present in the sibling iteritems method. An attacker who can control options passed to Commit.count e.g., via an...

SUSE CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...

SUSE CVE-2026-73623

GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute...

SUSE CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

SUSE CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

SUSE CVE-2026-73646

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

SUSE CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist fails, the error path frees fou while it is still reachable through...

SUSE CVE-2026-74520

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopfgroupalloc links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufdfaultiopfhandler also queued an accepted group in the...

SUSE CVE-2026-74525

In the Linux kernel, the following vulnerability has been resolved: net: sxgbe: free TX rings on RX allocation failure When RX descriptor ring allocation fails, initdmadescrings only frees the partially allocated RX rings and returns. The TX rings that were allocated earlier in the same function...

SUSE CVE-2026-74536

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix leaking sk after socket release isosockkill tests !sockflagsk, SOCKZAPPED || sk-sksocket || sockflagsk, SOCKDEAD for early return, but this is always true since sockorphansk sets SOCKDEAD, so the sk reference...