CVE-2026-64471

Bluetooth: btusb: fix use-after-free on registration failure

5.4 MediumFix available

What does this mean?

: 5.4v4.0, from OSV
: 0.18%8th percentile
Fixed in: 6.6.145.2-1kernel
Published: July 25, 2026
Modified: November 10, 2026
Also known as: AZL-93449BELL-CVE-2026-64471CLSA-2026-1789958474CLSA-2026-1791132071CLSA-2026-1791132078CLSA-2026-1791780738CLSA-2026-1791946572CLSA-2026-1791949745
Show 47 moreShow less
CLSA-2026-1792020435CLSA-2026-1792234299CLSA-2026-1792236238CLSA-2026-1792236273CLSA-2026-1792419819CLSA-2026-1792445930CLSA-2026-1792749577CLSA-2026-1792750763DEBIAN-CVE-2026-64471EUVD-2026-48815GHSA-h76x-2h2r-8jw4OESA-2026-3702ROOT-OS-UBUNTU-2204-CVE-2026-64471SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1SUSE-SU-2026:23897-1SUSE-SU-2026:23902-1SUSE-SU-2026:4120-1SUSE-SU-2026:4254-1SUSE-SU-2026:4282-1UBUNTU-CVE-2026-64471USN-8726-1USN-8726-2USN-8726-3USN-8726-4USN-8727-1USN-8728-1USN-8728-2USN-8728-3USN-8760-1USN-8760-2USN-8800-1USN-8875-1USN-8875-2USN-8876-1USN-8877-1USN-8878-1USN-8879-1USN-8917-1USN-8918-1USN-8963-1openSUSE-SU-2026:11476-1openSUSE-SU-2026:21910-1

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.18%Unchanged since Jul 25, 2026

What each source reports

OSV Score usedUBUNTU-CVE-2026-64471 5.4

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: UBUNTU-CVE-2026-64471
CVSS 4.0: 5.4 MediumCVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-10

CVE List No score

Bluetooth: btusb: fix use-after-free on registration failure

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: CVE-2026-64471
Updated: 2026-11-06

EUVDEUVD-2026-48815 No score

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: EUVD-2026-48815
Updated: 2026-11-06

GitHub AdvisoriesGHSA-h76x-2h2r-8jw4 No score

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use...

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: GHSA-h76x-2h2r-8jw4
Updated: 2026-11-02

NVD No score

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: CVE-2026-64471
Updated: 2026-11-09

OSVOESA-2026-3702 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/9p: fix double req put in p9_fd_cancelled

Syzkaller reports a KASAN issue as below:

general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead000000000108-0xdead00000000010f] CPU: 0 PID: 5083 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00037-g855bd1d7d838 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__list_del include/linux/list.h:114 [inline] RIP: 0010:__list_del_entry include/linux/list.h:137 [inline] RIP: 0010:list_del include/linux/list.h:148 [inline] RIP: 0010:p9_fd_cancelled+0xe9/0x200 net/9p/trans_fd.c:734

Call Trace: <TASK> p9_client_flush+0x351/0x440 net/9p/client.c:614 p9_client_rpc+0xb6b/0xc70 net/9p/client.c:734 p9_client_version net/9p/client.c:920 [inline] p9_client_create+0xb51/0x1240 net/9p/client.c:1027 v9fs_session_init+0x1f0/0x18f0 fs/9p/v9fs.c:408 v9fs_mount+0xba/0xcb0 fs/9p/vfs_super.c:126 legacy_get_tree+0x108/0x220 fs/fs_context.c:632 vfs_get_tree+0x8e/0x300 fs/super.c:1573 do_new_mount fs/namespace.c:3056 [inline] path_mount+0x6a6/0x1e90 fs/namespace.c:3386 do_mount fs/namespace.c:3399 [inline] __do_sys_mount fs/namespace.c:3607 [inline] __se_sys_mount fs/namespace.c:3584 [inline] __x64_sys_mount+0x283/0x300 fs/namespace.c:3584 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

This happens because of a race condition between:

The 9p client sending an invalid flush request and later cleaning it up;
The 9p client in p9_read_work() canceled all pending requests.
```
Thread 1                              Thread 2
```
... p9_client_create() ... p9_fd_create() ... p9_conn_create() ... // start Thread 2 INIT_WORK(&m->rq, p9_read_work); p9_read_work() ... p9_client_rpc() ... ... p9_conn_cancel() ... spin_lock(&m->req_lock); ... p9_fd_cancelled() ... ... spin_unlock(&m->req_lock); // status rewrite p9_client_cb(m->client, req, REQ_STATUS_ERROR) // first remove list_del(&req->req_list); ...

spin_lock(&m->req_lock) ... // second remove list_del(&req->req_list); spin_unlock(&m->req_lock) ...

Commit 74d6a5d56629 ("9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work") fixes a concurrency issue in the 9p filesystem client where the req_list could be deleted simultaneously by both p9_read_work and p9_fd_cancelled functions, but for the case where req->status equals REQ_STATUS_RCVD.

Update the check for req->status in p9_fd_cancelled to skip processing not just received requests, but anything that is not SENT, as whatever changed the state from SENT also removed the request from its list.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

updated the check from status == RECV || status == ERROR to status != SENT

In the Linux kernel, the following vulnerability has been resolved:

exfat: validate cluster allocation bits of the allocation bitmap

syzbot created an exfat image with cluster bits not set for the allocation bitmap. exfat-fs reads and uses the allocation bitmap without checking this. The problem is…

Record: OESA-2026-3702
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 47 moreShow less

OSVAZL-93449 No score

CVE-2026-64471 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: AZL-93449
Updated: 2026-11-02

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1791132071 No score

Fix of 159 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132071
Updated: 2026-11-02

OSVCLSA-2026-1791132078 No score

Fix of 160 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132078
Updated: 2026-11-02

OSVCLSA-2026-1791780738 No score

kernel: Fix of 72 CVEs

drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
firewire: net: remove unused variable 'guid' {CVE-2023-53432}
gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
gfs2: fix kernel…

Record: CLSA-2026-1791780738
Updated: 2026-11-02

OSVCLSA-2026-1791946572 No score

Fix of 198 CVEs

CVE-2024-36894
- usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
CVE-2026-97447
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
CVE-2026-93822
- PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
CVE-2026-93826
- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
CVE-2026-97954
- net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
CVE-2026-97949
- configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
CVE-2026-97931
- ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
CVE-2026-97940
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
CVE-2026-97539
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
CVE-2026-74510
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
CVE-2026-72084
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-90321
- ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-74637
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
CVE-2026-74752
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
CVE-2026-74387
- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
CVE-2026-80536
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
CVE-2026-89659
- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
CVE-2026-80576
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
CVE-2026-90223
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
CVE-2026-80994
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
CVE-2026-72398
- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
CVE-2026-74583
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
CVE-2026-72322
- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
CVE-2026-93095
- hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
CVE-2026-72472
- nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-90421
- PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
CVE-2026-64583
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
CVE-2026-68329
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
CVE-2026-89448
- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64305
- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
CVE-2026-64348
- usb: free iso schedules on failed submit {CVE-2026-64348}
CVE-2026-64422
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
CVE-2026-90180
- block:…

Record: CLSA-2026-1791946572
Updated: 2026-11-02

OSVCLSA-2026-1791949745 No score

kernel: Fix of 69 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1791949745
Updated: 2026-11-02

OSVCLSA-2026-1792020435 No score

kernel: Fix of 68 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1792020435
Updated: 2026-11-02

OSVCLSA-2026-1792234299 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792234299
Updated: 2026-11-02

OSVCLSA-2026-1792236238 No score

kernel: Fix of 74 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236238
Updated: 2026-11-02

OSVCLSA-2026-1792236273 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236273
Updated: 2026-11-02

OSVCLSA-2026-1792419819 No score

Fix of 74 CVEs

Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-*, distinct from the prior 4.19.0-29.
CVE-2021-3493
- vfs: move cap_convert_nscap() call into vfs_setxattr() {CVE-2021-3493}
- ecryptfs: fix uid translation for setxattr on security.capability {CVE-2021-3493}
CVE-2025-23142
- sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
CVE-2025-38352
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-52955
- libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
CVE-2026-53091
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2026-63814
- f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}
CVE-2026-63815
- f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815}
CVE-2026-63922
- ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
CVE-2026-63962
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64009
- xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
CVE-2026-64011
- nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}
CVE-2026-64372
- cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
CVE-2026-64378
- writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
- writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
CVE-2026-64381
- smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}
CVE-2026-64471
- Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
CVE-2026-64483
- ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
CVE-2026-64504
- iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504}
CVE-2026-64505
- usb: gadget: function: rndis: add length check for header {CVE-2026-64505}
CVE-2026-64541
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541}
CVE-2026-64543
- tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}
CVE-2026-64546
- drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
CVE-2026-64563
- rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
CVE-2026-64564
- sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
CVE-2026-72389
- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
CVE-2026-74444
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
CVE-2026-74454
- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454}
CVE-2026-74469
- sctp: prevent peer transport count overflow {CVE-2026-74469}
CVE-2026-74479
- net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
CVE-2026-74498
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
CVE-2026-74499
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() …

Record: CLSA-2026-1792419819
Updated: 2026-11-02

OSVCLSA-2026-1792445930 No score

kernel: Fix of 92 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545}
seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}
ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840}
i3c: master: svc: bound IBI payload to the requested max_payload_len {CVE-2026-80951}
i3c: master: svc: Use readsb helper for reading MDB {CVE-2026-80951}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access {CVE-2026-98365}
ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
drm/virtio: use uninterruptible resv lock for plane updates {CVE-2026-64098}
keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823}
exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808}
ethtool: cmis: require exact CDB reply length {CVE-2026-63996}
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 {CVE-2026-63994}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}
HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
bpf: Validate BTF repeated field counts before expansion {CVE-2026-64354}
USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
ALSA: seq: Serialize UMP output teardown with event_input {CVE-2026-64029}
xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992}
vsock/virtio: bind uarg before filling zerocopy skb {CVE-2026-63970}
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() {CVE-2026-64555}
drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
crypto: af_alg - zero initialize memory allocated via sock_kmalloc {CVE-2025-71113}
mailbox: mailbox-test: don't free the reused channel {CVE-2026-53294}
drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
nfsd: release layout stid on setlease failure {CVE-2026-53399}
fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
blk-mq: pop cached request if it is usable {CVE-2026-64017}
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}
posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268}
Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520}
net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
NFSD: Prevent client use-after-free during delegation revoke…

Record: CLSA-2026-1792445930
Updated: 2026-11-02

OSVCLSA-2026-1792749577 No score

kernel: Fix of 97 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
ice: fix double-free of tx_buf skb {CVE-2026-53009}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
sctp: prevent peer transport count overflow {CVE-2026-74469}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
nvme: add missing SRCU grace period in error path {CVE-2026-89972}
nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
fs/mbcache: cancel shrink work before destroying the…

Record: CLSA-2026-1792749577
Updated: 2026-11-02

OSVCLSA-2026-1792750763 No score

kernel: Fix of 91 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
dmaengine: Fix possible use after free {CVE-2026-72476}
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
thunderbolt: Bound root directory content to block size {CVE-2026-53149}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

Record: CLSA-2026-1792750763
Updated: 2026-11-02

OSV No score

Bluetooth: btusb: fix use-after-free on registration failure

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths.

Record: CVE-2026-64471
Updated: 2026-11-07

OSVDEBIAN-CVE-2026-64471 No score

Record: DEBIAN-CVE-2026-64471
Updated: 2026-11-07

OSVopenSUSE-SU-2026:11476-1 No score

kernel-devel-7.1.7-1.1 on GA media

These are all security issues fixed in the kernel-devel-7.1.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11476-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21910-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: openSUSE-SU-2026:21910-1
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-64471 No score

CVE-2026-64471 in linux - Patched by Root

Root has patched CVE-2026-64471 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-64471
Updated: 2026-11-06

OSVSUSE-SU-2026:23477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23481-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23481-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23528-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23528-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23529-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23529-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23881-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23881-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23887-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23887-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23897-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23897-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23902-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23902-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4120-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm…

Record: SUSE-SU-2026:4120-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4254-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm log: fix out-of-bounds write due…

Record: SUSE-SU-2026:4254-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4282-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (bsc#1264308).
CVE-2026-43257: media: cx88: Add missing unmap in snd_cx88_hw_params() (bsc#1264296).
CVE-2026-43277: ACPI / APEI: Make GHES estatus header validation more user friendly (bsc#1264594).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45941: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (bsc#1266920).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46108: ipmi:si: Return state to normal if message allocation fails (bsc#1267615).
CVE-2026-46128: ipmi: Check event message buffer response for bad data (bsc#1267643).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: do not use skb_mac_header() in qdisc_pkt_len_init() (bsc#1269530).
CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in (bsc#1271731).
CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
CVE-2026-63823: security: don't use RCU accessors for cred->session_keyring (bsc#1272182).
CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63891: thunderbolt:…

Record: SUSE-SU-2026:4282-1
Updated: 2026-11-02

OSVUSN-8726-1 No score

linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)