CVE-2026-31512

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

5.5 MediumFix available

What does this mean?

: 5.5v3.1, from NVD
: 0.12%2nd percentile
Fixed in: 6.1.168-r0linux-lts
Published: April 22, 2026
Modified: November 11, 2026
Also known as: BELL-CVE-2026-31512CLSA-2026-1782151303CLSA-2026-1782155469DEBIAN-CVE-2026-31512EUVD-2026-24895GHSA-r6qv-6h22-hpj4MGASA-2026-0108MGASA-2026-0110
Show 52 moreShow less
OESA-2026-2581OESA-2026-2582ROOT-OS-DEBIAN-11-CVE-2026-31512ROOT-OS-DEBIAN-12-CVE-2026-31512ROOT-OS-UBUNTU-2204-CVE-2026-31512ROOT-OS-UBUNTU-2404-CVE-2026-31512SUSE-SU-2026:2068-1SUSE-SU-2026:2111-1SUSE-SU-2026:21876-1SUSE-SU-2026:21877-1SUSE-SU-2026:21916-1SUSE-SU-2026:21919-1SUSE-SU-2026:2195-1SUSE-SU-2026:2202-1SUSE-SU-2026:2215-1SUSE-SU-2026:2216-1SUSE-SU-2026:2217-1SUSE-SU-2026:2238-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23237-1UBUNTU-CVE-2026-31512USN-8567-1USN-8574-1USN-8574-2USN-8574-3USN-8575-1USN-8575-2USN-8575-3USN-8576-1USN-8576-2USN-8595-1USN-8595-2USN-8595-3USN-8596-1USN-8597-1USN-8606-1USN-8607-1USN-8608-1USN-8609-1USN-8610-1USN-8619-1USN-8620-1USN-8620-2USN-8620-3USN-8620-4USN-8665-1USN-8668-1USN-8668-2openSUSE-SU-2026:21555-1

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb.

The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Apr 23, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Record: CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-05

CVE List No score

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Record: CVE-2026-31512
Updated: 2026-11-05

EUVDEUVD-2026-24895 No score

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Record: EUVD-2026-24895
Updated: 2026-11-05

GitHub AdvisoriesGHSA-r6qv-6h22-hpj4 5.5

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate...

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Record: GHSA-r6qv-6h22-hpj4
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-31512 5.5

Record: BELL-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-31512 5.5

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() l2cap_ecred_data_rcv() reads the SDU length field from skb->data using get_unaligned_le16() without first verifying that skb contains at least L2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads past the valid data in the skb. The ERTM reassembly path correctly calls pskb_may_pull() before reading the SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the same validation to the Enhanced Credit Based Flow Control data path.

Record: DEBIAN-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Show 48 moreShow less

OSVOESA-2026-2581 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where mvpp2_set_rx_mode() ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the rx_classifier_drops counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...

According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.

This patch fixes this issue by moving the 'subflow_req->msk' under the own_req == true conditional.

Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.(CVE-2025-23145)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

Record: OESA-2026-2581
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-2582 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] <TASK> [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update.(CVE-2025-39833)

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Add support for Van Gogh SoC

The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend.

Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang.(CVE-2025-68334)

In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0…

Record: OESA-2026-2582
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2026-31512 5.5

CVE-2026-31512 in linux - Patched by Root

Root has patched CVE-2026-31512 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-31512 5.5

CVE-2026-31512 in linux - Patched by Root

Root has patched CVE-2026-31512 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-31512 5.5

CVE-2026-31512 in linux - Patched by Root

Root has patched CVE-2026-31512 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-31512 5.5

CVE-2026-31512 in linux - Patched by Root

Root has patched CVE-2026-31512 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31512
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31512 7.1

Record: UBUNTU-CVE-2026-31512
CVSS 4.0: 7.1 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1782151303 No score

kernel: Fix of 151 CVEs

spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
net: Fix an unsafe loop on the list {CVE-2024-50024}
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
xen/netfront: stop tx queues during live migration {CVE-2022-48969}
Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
RDMA/irdma: Initialize…

Record: CLSA-2026-1782151303
Updated: 2026-11-02

OSVCLSA-2026-1782155469 No score

kernel: Fix of 143 CVEs

ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
cpuset: fix warning when disabling remote partition {CVE-2025-71142}
virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
idpf: fix error handling in the init_task on load {CVE-2026-23017}
rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

Record: CLSA-2026-1782155469
Updated: 2026-11-02

OSV No score

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()

Record: CVE-2026-31512
Updated: 2026-11-07

OSVMGASA-2026-0108 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0108
Updated: 2026-11-02

OSVMGASA-2026-0110 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0110
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21555-1 No score