SUSE CVE-2026-94624

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kvtransferparams to create unreachable peer sessio...

SUSE CVE-2026-94625

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 4...

SUSE CVE-2026-94626

vLLM through 0.29.0 fails to validate the tpsize parameter in kvtransferparams on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tpsize values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel...

SUSE CVE-2026-94627

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts,...

SUSE CVE-2026-94640

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

SUSE CVE-2026-71543

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter pa...

SUSE CVE-2026-73511

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

SUSE CVE-2026-73512

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the...

SUSE CVE-2026-73549

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string...

SUSE CVE-2026-73550

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

SUSE CVE-2026-73551

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

SUSE CVE-2026-77165

File owners were unable to unlock TYPETOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database...

SUSE CVE-2026-77680

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

SUSE CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

SUSE CVE-2026-90149

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session...

SUSE CVE-2026-90152

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbdsessionregister See the procedure below: smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset&sess-refcnt, 2 hashaddsessionstable, &sess-hlist, sess-id ksmbdsessionregister...

SUSE CVE-2026-90184

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

SUSE CVE-2026-90204

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read BUG A corrupted append-DIO dinode high byte at offset 0xa1 corrupted from 0 to 1 can carry an idioorphanedslot outside the mounted filesystem slot range and trigger a use-after-fr...

SUSE CVE-2026-90245

In the Linux kernel, the following vulnerability has been resolved: fbdev: kyro: Validate overlay viewport coordinates The overlay viewport end coordinates are computed from the viewport origin and dimensions using 32-bit unsigned arithmetic. Large input values can cause these calculations to wra...

SUSE CVE-2026-90262

In the Linux kernel, the following vulnerability has been resolved: btrfs: retry verity reads for not-uptodate Merkle folios btrfsreadmerkletreepage can find a folio in the mapping that is not uptodate. After taking the folio lock, the current code treats that state as a read error and returns...

SUSE CVE-2026-90267

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix specialvec mempool leak when scsiallocsgtables fails sdsetspecialbvec allocates a special payload page for UNMAP and WRITE SAME commands. If scsiallocsgtables fails afterward in sdsetupunmapcmnd or...

SUSE CVE-2026-90269

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

SUSE CVE-2026-90304

In the Linux kernel, the following vulnerability has been resolved: ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPTRT requires interrupts to be enabled when sending signals. When doDataAbort/doPrefetchAbort triggers unhandled user faults, that is inf-fn return a...

SUSE CVE-2026-90307

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

SUSE CVE-2026-90324

In the Linux kernel, the following vulnerability has been resolved: ublk: check importubuf return value importubuf can fail if the address range provided by the userspace ublk server is outside the allowed user address space. Return that 0 bytes were copied if importubuf fails rather than passing...

SUSE CVE-2026-90374

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate RX bandidx before dereferencing phys bandidx comes from a 2-bit descriptor field 0-3 and was used directly to index dev-mt76.phys size MTMAXBAND == 3 and dereference the result. A corrupt or reserved...

SUSE CVE-2026-90375

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix non-AQL packet accounting for MLO stations mt76txqueueskb overrides the wcid passed by the driver with sta-drvpriv, so the wcid might incorrectly be changed after TX, causing wcid-nonaqlpackets to be counted on th...

SUSE CVE-2026-90376

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP Problem: MCU command timeout while the firmware state is normal, and the firmware keeps showing the error log "ERROR!! NO PAUSE...". Root cause: If the MLDID field in the TXD ...

SUSE CVE-2026-90381

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: fix handling channel context with different bands in mt76switchvifchanctx When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each...

SUSE CVE-2026-90382

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length The MPDU length in the rx descriptor comes from the hardware. In monitor mode with the fcsfail filter enabled, the hardware passes up corrupted frames, and a...

SUSE CVE-2026-90383

In the Linux kernel, the following vulnerability has been resolved: misc: sgi-gru: remove interrupt-context page-table walks The GRU TLB miss handler walks a process's page tables without holding page-table locks or a reference to the mapped page. It also uses a kernel page-table accessor on user...

SUSE CVE-2026-90386

In the Linux kernel, the following vulnerability has been resolved: i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices On an empty bus ENTDAA assigns nothing, so cmd-rxlen the count of addresses left unassigned equals master-maxdevs. The GENMASK index master-maxdevs - cmd-rxlen - 1 th...

SUSE CVE-2026-90388

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Check atomic pool allocation result directly The non-blocking, non-coherent allocation path uses dmaallocfrompool, which returns the allocated page and fills cpuaddr only on success. Do not rely on cpuaddr to detect...

SUSE CVE-2026-90389

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

SUSE CVE-2026-90393

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF in bpfnetnslinkupdateprog In bpfnetnslinkupdateprog, the checks for oldprog and prog type are currently performed locklessly before acquiring netnsbpfmutex. This creates a race condition that can lead to a...

SUSE CVE-2026-90395

In the Linux kernel, the following vulnerability has been resolved: power: supply: isp1704charger: cancel work on remove The USB notifier and initial VBUS detection can schedule isp-work. The remove path unregisters the notifier and power supply, but does not wait for queued or running work befor...

SUSE CVE-2026-90403

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix error path in rtlpciprobe In the last error path in rtlpciprobe, the cleanup functions are skipped due to a wrong goto label. Moreover, the successful call to rtlinitrfkill, ieee80211registerhw,...

SUSE CVE-2026-90406

In the Linux kernel, the following vulnerability has been resolved: media: qcom: iris: handle runtime PM resume failure in core deinit Check the return value of pmruntimeresumeandget in iriscoredeinit. If runtime PM resume fails, skip hardware power-off operations but still perform software...

SUSE CVE-2026-90408

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix overreads in ath12kwmiprocesscsaswitchcountevent There is no policy entry for WMITAGPDEVCSASWITCHCOUNTSTATUSEVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally...

SUSE CVE-2026-90409

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Add vmbind region with kbo range overlap check When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vmbind mappings of UM-exposed BO's...

SUSE CVE-2026-90414

In the Linux kernel, the following vulnerability has been resolved: IB/isert: reject PDUs declaring more data than was received isertrecvdone hands each received PDU to the opcode handlers without ever looking at wc-bytelen, the number of bytes the HCA actually placed in the receive descriptor. T...

SUSE CVE-2026-90416

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

SUSE CVE-2026-90420

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfscleansegments syzbot reported a hung task in nilfstransactionbegin. This occurs because the cleaner ioctl falls into an infinite loop if nilfssegctorconstruct repeatedly returns -EROFS e.g. the...

SUSE CVE-2026-90425

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241vintfinitvsid maps a guest vSID to a single physical Stream ID taken from master-streams0, and only warns when the device does not have exactly one stream. A...

SUSE CVE-2026-90426

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241cmdqvremove tears each VINTF down first, then calls freeirq. Tearing a VINTF down frees vintf0 and clears cmdqv-vintfs0. An error in that window makes...

SUSE CVE-2026-90427

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devmkrealloc tegra241cmdqvprobe uses devmkrealloc to grow @smmu into the larger tegra241cmdqv, which frees the original @smmu once it relocates. A failure after that...

SUSE CVE-2026-90429

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF deinit A user VINTF is torn down by tegra241cmdqvdeinitvintf, which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the...

SUSE CVE-2026-90431

In the Linux kernel, the following vulnerability has been resolved: remoteproc: Prevent crash handling to race with rprocdel There's no synchronization between rproccrashhandlerwork and rprocdel, as such it's possible for a driver to be removed while crash-handler work is scheduled, or even...

SUSE CVE-2026-90434

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead, the loop also releases the old bufferhead when it advances. However, the...

SUSE CVE-2026-90435

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...