SUSE CVE-2026-49851

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately On^2 behavior in parselinktext. When parsing Markdown containing many consecutive characters, parselinktext repeatedly scans the input usi...

SUSE CVE-2026-50020

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, HttpObjectDecoder skips every byte for which Character.isISOControlb is true 0x00-0x1F and 0x7F as well as all...

SUSE CVE-2026-53524

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relaywebsocketinflate has no upper bound on output size. An authenticated relay user can send a small compressed WebSock...

SUSE CVE-2026-54887

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...

SUSE CVE-2026-55769

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

SUSE CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

SUSE CVE-2026-97571

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

SUSE CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

SUSE CVE-2026-97602

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...

SUSE CVE-2026-97609

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nfctsettimeout protects the timeout hook dereference and policy lookup with rcureadlock. cttimeoutexit, however, unregisters the per-net operations before it clears the hook...

SUSE CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

SUSE CVE-2026-97618

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

SUSE CVE-2026-98015

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

SUSE CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

SUSE CVE-2026-98034

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise checkmapkptraccess permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it...

SUSE CVE-2026-98040

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

SUSE CVE-2026-98043

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

SUSE CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

SUSE CVE-2026-98077

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

SUSE CVE-2026-98080

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

SUSE CVE-2026-98081

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

SUSE CVE-2026-98082

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

SUSE CVE-2026-98083

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...

SUSE CVE-2026-98084

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

SUSE CVE-2026-98085

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

SUSE CVE-2026-98088

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

SUSE CVE-2026-98156

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...

SUSE CVE-2026-103387

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been...

SUSE CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

SUSE CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...

SUSE CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format TNEF file containing multiple message bodies. During extraction, improper memory management triggers a use-after-free and double-free condition,...

SUSE CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the findfreenumber function when generating numbered backup suffixes for duplicate filenames. When numbered backups are enabled and file overwriting is disabled, an attacker can supply a specially crafted Transport Neutral...

SUSE CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

SUSE CVE-2026-76561

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...

SUSE CVE-2026-80110

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...

SUSE CVE-2026-88030

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

SUSE CVE-2026-97529

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied requestlen. For FCBSGHSTVENDOR, fcbsghostdispatch only guarantees requestlen...

SUSE CVE-2026-97531

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Skip vport under deletion in report ID acquisition qla24xxreportidacquisition format-1 handling walks ha-vplist under vportslock, takes a vrefcount on the matching vport and calls qlaupdatehostmap to register its...

SUSE CVE-2026-97535

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound VP index against VPCTRL IOCB bitmap size The VP control IOCB selects its target virtual port by setting one bit in vpidxmap, a fixed 16-byte 128-bit array in both vpctrlentry24xx and vpctrlentry24xxext...

SUSE CVE-2026-97536

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown The response queue MSI-X handler qla2xxxmsixrspq schedules qladowork via queueworkha-wq, &qpair-qwork. qladowork dereferences the qpair vha, rsp and takes...

SUSE CVE-2026-97538

In the Linux kernel, the following vulnerability has been resolved: hwmon: asusrogryujin Validate HID report lengths rogryujinrawevent parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consu...

SUSE CVE-2026-97539

In the Linux kernel, the following vulnerability has been resolved: usb: xusbatm: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that is...

SUSE CVE-2026-97540

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

SUSE CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

SUSE CVE-2026-97551

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

SUSE CVE-2026-97553

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

SUSE CVE-2026-97554

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

SUSE CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

SUSE CVE-2026-97556

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

SUSE CVE-2026-97558

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...