SUSE CVE-2026-90212

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

SUSE CVE-2026-90214

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: fix streamdata leak on open error In xlnxformatterpcmopen, streamdata is allocated and adata-playstream or adata-capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep or...

SUSE CVE-2026-90216

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubiinitattach rolls back module initialization failures by scanning ubidevices0..i-1, where i is the mtd= parameter index. That assumes the parameter index matches the UBI device...

SUSE CVE-2026-90217

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACKITER slots...

SUSE CVE-2026-90219

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

SUSE CVE-2026-90221

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix use of uninitialized memory in COREINITRSP parsing ncicoreinitrsppacketv1 and ncicoreinitrsppacketv2 parse the COREINITRSP packet without validating that the skb contains enough data. A malformed response e.g...

SUSE CVE-2026-90222

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

SUSE CVE-2026-90223

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound SNL TLV parsing to the skb and add length checks nfcllcprecvsnl walked the SNL TLV list using a u16 offset/length pair derived from skb-len, without bounding reads to the actual skb data. Three problems followed:...

SUSE CVE-2026-90224

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix double completion race in ncidataexchangecomplete nciclosedevice and ncirxwork can both call ncidataexchangecomplete concurrently. After commit 4527025d440ce8 "nfc: nci: fix circular locking dependency in...

SUSE CVE-2026-90225

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached pointer inside the locked region. llcpsockbind assigns and clears...

SUSE CVE-2026-90226

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

SUSE CVE-2026-90229

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Destroy the admin queue on removal The admin queue is allocated with blkmqallocqueue but never destroyed. nvmefreectrl only drops the last reference and blkmqexitqueue and blksyncqueue never run: the hctx is never mov...

SUSE CVE-2026-90231

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined is not correctly, applied. This results in an escape if two transitio...

SUSE CVE-2026-90232

In the Linux kernel, the following vulnerability has been resolved: amt: Don't support cross-netns setup. When a lower device is unregistered, amtdeviceevent tries to unregister its upper AMT device, but it has two problems. 1. amtlookupupperdev looks up an upper device in the lower device's netn...

SUSE CVE-2026-90233

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon once the admin tag set is allocated, but they are only destroyed in nvmeremove via...

SUSE CVE-2026-90235

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

SUSE CVE-2026-90236

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

SUSE CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

SUSE CVE-2026-90242

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

SUSE CVE-2026-90244

In the Linux kernel, the following vulnerability has been resolved: iommu/dma: Restore locking around msipagelist Unlike a group's default domain, which is always freshly allocated and privately owned iommugroupallocdefaultdomain, VFIO type1's legacy container merges any newly attached group into...

SUSE CVE-2026-90246

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix integer overflow in verifytags bounds check verifytags validates the tagset table unpacked from a policy blob. For each set it reads a count and checks that advancing the index by that count stays inside sets.table:...

SUSE CVE-2026-90247

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

SUSE CVE-2026-90248

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: fix teardown of an adopted proto on insert-race loss In tcnewtfilter the create branch sets tpcreated = 1 before calling tcfchaintpinsertunique. When the caller loses the race another request inserted a proto a...

SUSE CVE-2026-90249

In the Linux kernel, the following vulnerability has been resolved: iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes The IIO core does not filter duplicate writes to the event enable attribute, so writing the same value twice invokes writeeventconfig twice. Enabling twice...

SUSE CVE-2026-90250

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

SUSE CVE-2026-90251

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MSFT: validate evtprefixlen against the response length readsupportedfeatures only checks that the response covers the fixed part of struct msftrpreadsupportedfeatures, which is 11 bytes: if skb-len evtprefixlen is an...

SUSE CVE-2026-90252

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync runs. A cancelled entry is leaked, as hcicmdsynccancelentry...

SUSE CVE-2026-90253

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled meshsendcancel queues the pending command with a NULL destroy callback, so it is only freed if sendcancel runs. A cancelled entry is leaked, as...

SUSE CVE-2026-90254

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

SUSE CVE-2026-90256

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use protolock for l2capdata to fix l2capdisconnind hciconn::l2capdata is accessed without locks in l2capdisconnind via hciconntimeout discwork - hciprotodisconnind - l2capdisconnind. This is UAF if the l2capconn...

SUSE CVE-2026-90257

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: virtiobt: avoid OOB read of build info string The virtbtsetupzephyr sends the Zephyr vendor command 0xfc08 Read Build Information and hands the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-da...

SUSE CVE-2026-90259

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix a wrong length calculation in qgroupfreereserveddata In that function, we round down the start position and round up the ending position. But during the calculation of @len, we use "roundupstart + len,...

SUSE CVE-2026-90260

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros EXTENTBUFFERZONEDZEROOUT only to keep the zone write pointer advancing...

SUSE CVE-2026-90263

In the Linux kernel, the following vulnerability has been resolved: btrfs: check if root is readonly when setting posix acl For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs r...

SUSE CVE-2026-90265

In the Linux kernel, the following vulnerability has been resolved: btrfs: defrag: fix deadlock between defrag and delalloc space reservation While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and...

SUSE CVE-2026-90266

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge On a zoned FS, btrfsdelayedrefsrsvrefill returns -EAGAIN whenever the over-committed metadata plus the zoneunusable bytes exceeds the usable size in a...

SUSE CVE-2026-90268

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

SUSE CVE-2026-90271

In the Linux kernel, the following vulnerability has been resolved: armmpam: Fix a NULL pointer dereference on unbinding after an error interrupt If a user unbinds an MSC after mpamdisable has been run in response to an error interrupt then a dereference of a NULL pointer occurs as mpamdisable se...

SUSE CVE-2026-90275

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

SUSE CVE-2026-90276

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

SUSE CVE-2026-90279

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

SUSE CVE-2026-90282

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend There is a small window where the runtime suspend callback may run after pmruntimeenable and before pmruntimeforbid. In this case, a crash occurs because...

SUSE CVE-2026-90283

In the Linux kernel, the following vulnerability has been resolved: hugetlbfs: release subpool on fillsuper failure hugetlbfsfillsuper allocates a hugepage subpool when size or minsize mount options are specified. hugepagenewsubpool may also reserve huge pages for minsize. If root dentry creation...

SUSE CVE-2026-90284

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: do not queue completed sysfs fallback requests fwloadsysfsfallback calls deviceadd before adding the fwpriv to pendingfwhead. deviceadd publishes the fallback loading interface, so a userspace helper which discove...

SUSE CVE-2026-90285

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00sysfsreadvpd called ha-ispops-readoptrom a second time after releasing optrommutex. The repeated read is redundant and, unlike the first, runs without...

SUSE CVE-2026-90287

In the Linux kernel, the following vulnerability has been resolved: phy: sunplus: fix error handling in spuphyinit Fix the error paths of spuphyinit to undo exactly what each stage did: return directly if clkprepareenable fails, release only the clock if resetcontroldeassert fails, and jump to...

SUSE CVE-2026-90288

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure foreachchildofnodescoped releases the node reference on scope exit, so the explicit ofnodeputnp in the devmphycreate error path drops it twice. Drop the...

SUSE CVE-2026-90290

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported that if swsuspmtesavetags for some reason fails we return from swsusparchsuspend with DAIF being masked - that is not what we'd expect. Restore the saved DAIF...

SUSE CVE-2026-90291

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

SUSE CVE-2026-90292

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...