SUSE CVE-2026-98133

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

SUSE CVE-2026-98136

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound $AttrDef table walk to the loaded table size ntfsattrfindinattrdef walks the in-memory $AttrDef table, but the loop condition bounds only the start of each entry, not the whole entry: for ad = vol-attrdef; u8 ad - u8...

SUSE CVE-2026-98139

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

SUSE CVE-2026-98141

In the Linux kernel, the following vulnerability has been resolved: ntfs: propagate reparse index insertion failure updatereparsedata ignores the return value of setreparseindex. When index insertion fails, the code removes the just-written reparse data as cleanup but still returns 0, so symlink2...

SUSE CVE-2026-98143

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPUSETIFM,OFMPRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser h...

SUSE CVE-2026-98144

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: put the chained BO when its mapping fails amdxdnacmdseterror looks up the first BO of a command chain, which takes a reference, and drops it at the end of the function. The mapping of that BO is established in...

SUSE CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

SUSE CVE-2026-98147

In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthreadrun failure. Since kthreadcreateonnode returns -EINTR upon SIGKILL, we should not use WARNON in order to catch kthreadrun failure...

SUSE CVE-2026-98148

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

SUSE CVE-2026-98149

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

SUSE CVE-2026-98151

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

SUSE CVE-2026-98152

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

SUSE CVE-2026-98153

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

SUSE CVE-2026-98154

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

SUSE CVE-2026-98155

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

SUSE CVE-2026-98157

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

SUSE CVE-2026-98159

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...

SUSE CVE-2026-98160

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...

SUSE CVE-2026-98162

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2treeconnect See the procedure below: smb2treeconnect ksmbdtreeconnconnect xastore&sess-treeconns, treeconn-id, treeconn ksmbdcounterincKSMBDCOUNTERTREECONNS ksmbdsharetreeconnincsc...

SUSE CVE-2026-100070

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: rewind offset when NAT shrinks the packet sashiko says: If mapaddr changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offs...

SUSE CVE-2026-100071

In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...

SUSE CVE-2026-100072

In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpibusgetprimarydevice The acpigetfirstphysicalnode usage in acpiplatformfillresource and acpicreateplatformdevice is generally unsafe because in theory the device returned by it may be freed at any time 1. I...

SUSE CVE-2026-100073

In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb "ext4: correct the reserved credits for extent conversion" was correct to note that we need to reserve enough credits for all extents possibly underlying a large...

SUSE CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

SUSE CVE-2026-88359

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fyatomiterformat. When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca inside a loop. The allocated stack memory is not...

SUSE CVE-2026-88841

unknown...

SUSE CVE-2026-93205

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Manage teardown with devm armsmmudeviceremove manually frees the IOPF queue, destroys the vmidmap and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove returns, so...

SUSE CVE-2026-93206

In the Linux kernel, the following vulnerability has been resolved: PCI/proc: Use filenscapable when checking config space read access procbuspciread decides how much of the config space is readable based on capableCAPSYSADMIN, which checks the credentials of the task calling read, not the...

SUSE CVE-2026-93207

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpcgsswirecred at svcauthgssdecodecredbody entry svcauthgssdecodecredbody writes the caller's rpcgsswirecred field by field and assigns gcctx.len only on the success tail. The caller storage is svcdata-clcred, which...

SUSE CVE-2026-93208

In the Linux kernel, the following vulnerability has been resolved: kasan: fix cache shrink race with CPU hotplug kasanquarantineremovecache first invokes percpuremovecache on all online CPUs. Each callback moves objects belonging to the cache from cpuquarantine to the CPU's shrinkqlist, where th...

SUSE CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

SUSE CVE-2026-93210

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden DFS cache against invalid target hints Currently, gettgtname returns ERRPTR-ENOENT when ce-tgthint is NULL, and dfscachenorequpdatetgthint assumes ce-tgthint is always valid. In preparation for clearing...

SUSE CVE-2026-93211

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize DRC hash table before registering shrinker shrinkerregister precedes the INITLISTHEAD loop and the drchashsize store. On weakly-ordered architectures arm64, ppc, a shrinker scan can observe drchashsize before the...

SUSE CVE-2026-93212

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsdserv deref in nfsdfilenetdispose nfsdfilenetdispose is the consumer side of l-freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via...

SUSE CVE-2026-93213

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...

SUSE CVE-2026-93214

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: fix deadlock in usbgmaketpg usbgmaketpg held deplock while calling configfsdependitemunlocked, which acquires the configfs root inode lock when operating across subsystems. This creates a circular lock dependen...

SUSE CVE-2026-93216

In the Linux kernel, the following vulnerability has been resolved: mm/pageowner: use memcgdata snapshot to avoid TOCTOU in printpageownermemcg printpageownermemcg reads page-memcgdata via READONCE at the start to guard against tail pages and NULL data. However, it later re-reads page-memcgdata...

SUSE CVE-2026-93217

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

SUSE CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

SUSE CVE-2026-93219

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sun4i: Advertise a real minimum delta sun4iclkevtnextevent compensates for the timer stop/start synchronization delay by programming evt - TIMERSYNCTICKS into the hardware interval register. The clockeve...

SUSE CVE-2026-93220

In the Linux kernel, the following vulnerability has been resolved: schedext: Keep kicksync waiting on the rq's own CPU kicksyncwaitbalcb assumes it runs on the rq's CPU from the schedule tail: the snapshots it compares against live in that CPU's percpu area and the busy-wait runs with the rq loc...

SUSE CVE-2026-93222

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

SUSE CVE-2026-93224

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rnunregister on failed accept When svcrdmaaccept takes the errout path before rpcrdmarnregister has succeeded, the existing cleanup block calls rpcrdmarnunregisterdev, &newxprt-scrn unconditionally...

SUSE CVE-2026-93225

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...

SUSE CVE-2026-93226

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

SUSE CVE-2026-93227

In the Linux kernel, the following vulnerability has been resolved: mm/mminit: deferredgrowzone: fix out-of-range firstdeferredpfn With CONFIGDEFERREDSTRUCTPAGEINIT enabled, deferredgrowzone initializes struct pages early in boot to satisfy an allocation. With a large CMA reservation in place, th...

SUSE CVE-2026-93230

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier Gigantic bootmem HugeTLB pages are currently initialized from hugetlbinit, but pageallocinitlate runs earlier and walks pageblocks to determine zone contiguity...

SUSE CVE-2026-93232

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix boot panic with CONFIGDEBUGVM and HVO bootmem pages Patch series "mm: Refactor bootmem gigantic hugepage allocation", v4. This series is split out from the earlier larger series "mm: Generalize HVO for HugeTLB and...

SUSE CVE-2026-93233

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dmem: fix callocated underflow on large folio split nouveaudmemfoliofree drops chunk-callocated once per freed folio, while a large compound device-private folio is only counted once when it is allocated. When such a...

SUSE CVE-2026-93234

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUDCONNECTORTVMODENAMELEN entries and requires each name to be NUL-terminated. gudconnectoraddtvmode currently...