SUSE CVE-2026-93235

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to zero post-EOF data when extending file size generic/794 4s ... - output mismatch see /share/git/fstests/results//generic/794.out.bad --- tests/generic/794.out 2026-06-12 08:46:32.766426241 +0800 +++...

SUSE CVE-2026-93236

In the Linux kernel, the following vulnerability has been resolved: media: meson: vdec: fix NULL pointer deref in vdectryfmtcommon When VIDIOCTRYFMT is called with an unsupported pixel format on the OUTPUT queue, vdectryfmtcommon falls back to V4L2PIXFMTMPEG2. However, if a distro has locally...

SUSE CVE-2026-93238

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix potential use of uninitialized apmfiltered bitmap The DECLAREBITMAPapmfiltered, APDEVICES macro allocates the bitmap on the stack without zero-initializing it. In vfioapmdevhotplugcfg, the vfioapmdevfiltermatrix...

SUSE CVE-2026-93239

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...

SUSE CVE-2026-93242

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix response queue over-consumption in qlaconsumeiocb qla24xxprocessresponsequeue advances ringptr past the head IOCB before dispatching, so by the time qlaconsumeiocb runs, ringptr already points at the first...

SUSE CVE-2026-93243

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...

SUSE CVE-2026-93247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev-discovery.uuids' NULL dereference 'uuidcount' member of struct 'discoverystate' is assigned and read without any locks, so there is a chance of situation when uuidcount != 0, but uuids is NULL and there...

SUSE CVE-2026-93248

In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xewedged@wedged-at-any-timeout wedges the device in mode 2 UPONANYHANGNORESET and then rebinds the driver. During unbind, a GSC proxy kernel submission can...

SUSE CVE-2026-93249

In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initializ...

SUSE CVE-2026-93250

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbflush vxlanmdbflush iterates over the MDB entries using hlistforeachentrysafe, which only tolerates the removal of the current entry. Contrary to the comment above the loop, the removal o...

SUSE CVE-2026-93251

In the Linux kernel, the following vulnerability has been resolved: ACPI: bus: Introduce acpibusgetprimarydevice The function used for obtaining the first "physical" device for which the given ACPI one is the ACPI companion, acpigetfirstphysicalnode, may return a stale device pointer mostly in...

SUSE CVE-2026-93253

In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 "memblock: warn when freeing reserved memory before memory map is initialized", the following warning...

SUSE CVE-2026-93254

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary localirqdisable on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable befo...

SUSE CVE-2026-93255

In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure EXTENTBUFFERREADING is cleared under refslock FALSE ALERTS There is a bug report that the warning inside invalidateandcheckbtreefolios got triggered during btrfs/298: BTRFS info device sdd: first mount of...

SUSE CVE-2026-93256

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during resume. When a hibernation image is save...

SUSE CVE-2026-93259

In the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIGPPCKERNELPCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register 0. Both calldoirq and calldosoftirq use inline...

SUSE CVE-2026-93260

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xiveinitipis fails e.g. irqdomainallocirqs fails, the error path frees the global xiveipis array. However, xivesmpprobe previously ignored this failure and...

SUSE CVE-2026-93261

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in locksetclass registerlockclass can return NULL when the lock class pool is exhausted, graphlock fails, or key validation fails. However, locksetclass uses the return value directly...

SUSE CVE-2026-93262

In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppldoflush The loop in ppldoflush continues iterating after calling ppliounitfinished, touching io-pendingflushes and leading to a use-after-free. Add a break statement to stop the loop once io...

SUSE CVE-2026-93264

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses EFAPTRSPERCHUNK...

SUSE CVE-2026-93265

In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such as ASPM. The Endpoint device has two...

SUSE CVE-2026-93266

In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to &regs.a1 makes FORTIFY treat the destination as the single a1 field, resulting in a...

SUSE CVE-2026-93268

In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4trytoexpandextraisize is called from ext4markinodedirty while holding an active jbd2 handle. During mount !SBACTIVE, the expand path may move xattrs to externa...

SUSE CVE-2026-93269

In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem and sbinternal freeze protection. The deadlock scenario: CPU0...

SUSE CVE-2026-93270

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for BPFADDRPERCPU insn The BPFMOV64PERCPUREG insn requires JIT to emit native code to for 'dstreg = srcreg + '. However, the interpreter ignores the 'off' at its ALU64MOVX label. The 'off'...

SUSE CVE-2026-93272

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomwcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from numpdvregs to numpds, which would shift the info...

SUSE CVE-2026-93273

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594regulatorprobe, the multi-phase configuration loop calls offindnodebyname to find buck nodes by name, and ofgetparent twice to navigate to the PMIC...

SUSE CVE-2026-93274

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devmpinctrlregister function fails, bcm2835pinctrlprobe calls gpiochipremove before gpiochipadddata has registered the GPIO chip. This means that upon failure the...

SUSE CVE-2026-93275

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pteventstop is called without PERFEFUPDATE flag, then perfauxoutputend is not called. A subsequent call to pteventstart will call perfauxoutputbegin again which violates the rul...

SUSE CVE-2026-93276

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devmregulatorgetexclusive initialises the regulator with enablecount = 1, requiring the consumer to disable it before release. The devm...

SUSE CVE-2026-93277

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy...

SUSE CVE-2026-93279

In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing taskletkill in cvmocttxshutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvmocttxdocleanup. There can be a pending tasklet in the queue which might run after the...

SUSE CVE-2026-93280

In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gbaudiogbgettopology fetches a topology blob of a module-supplied size, and gbaudiotplgparsedata then walks it by adding the module-supplied sizedais,...

SUSE CVE-2026-93281

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89maccheckheobssnarrowbwruiter reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen = 11 before...

SUSE CVE-2026-93282

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated sessi...

SUSE CVE-2026-93284

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drmpagemapmigrateunmappages relies on the pages array to determine which pages require DMA unmapping. However, drmpagemapmigrationunlockputpages clears the array as pa...

SUSE CVE-2026-93285

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fsgckthread in f2fssbinfo Instead of allocating f2fsgckthread dynamically, embed it in f2fssbinfo. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbistore -...

SUSE CVE-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarpsendddp aarpsendddp calls atalkfinddevaddrdev in the LocalTalk fast path without checking for NULL. When the device has no AppleTalk interface configured dev-atalkptr == NULL,...

SUSE CVE-2026-93287

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data-block0 is validated in i2csmbusxferemulated but that check runs too late for tracepoints and is skipped entirely when the adapte...

SUSE CVE-2026-93781

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsiehlockdoor scsiehlockdoor is called from scsirestartoperations while the host is still in the SHOSTRECOVERY state, i.e. before the host is switched back to SHOSTRUNNING and...

SUSE CVE-2026-93782

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

SUSE CVE-2026-93783

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

SUSE CVE-2026-93785

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

SUSE CVE-2026-93786

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...

SUSE CVE-2026-93788

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: acpi: validate WGDS table revision index Check tblrev bounds before BITtblrev to avoid undefined shifts when firmware reports an invalid revision value...

SUSE CVE-2026-93790

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tiddata access in BA notif mvmsta-tiddata was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lqcolor into a random tiddata slot unrelated to the BA...

SUSE CVE-2026-93791

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

SUSE CVE-2026-93792

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a possible underflow We shouldn't trust the firmware about the length of the wowlan packet...

SUSE CVE-2026-93794

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

SUSE CVE-2026-93795

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radixtreeinsert failure When radixtreeinsert fails in blkgcreate, the error path has two issues: 1. blkg-online is set to true unconditionally, even when the blkg was never fully inserted...