CVE-2026-74408

wifi: ath9k: fix OOB access from firmware tx status queue ID

8.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.41%Up 0.2 points since Aug 15, 2026

What each source reports

CVE List Score used 8.8

wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Record: CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-59555 8.8

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Record: EUVD-2026-59555
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6hv7-5h9p-9jrw 8.8

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access...

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Record: GHSA-6hv7-5h9p-9jrw
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 8.8

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Record: CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-74408 8.8

Record: BELL-CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.8

wifi: ath9k: fix OOB access from firmware tx status queue ID

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: fix OOB access from firmware tx status queue ID

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access.

Add a bounds check on ts.qid before using it as an array index.

Record: CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

Show 35 moreShow less

OSVDEBIAN-CVE-2026-74408 8.8

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: fix OOB access from firmware tx status queue ID ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a 4-bit hardware field (0-15), but the txq array only has ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array access. Add a bounds check on ts.qid before using it as an array index.

Record: DEBIAN-CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4357 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: reject index allocation if $BITMAP is empty but blocks exist

Index allocation requires at least one bit in the $BITMAP attribute to track usage of index entries. If the bitmap is empty while index blocks are already present, this reflects on-disk corruption.

syzbot triggered this condition using a malformed NTFS image. During a rename() operation involving a long filename (which spans multiple index entries), the empty bitmap allowed the name to be added without valid tracking. Subsequent deletion of the original entry failed with -ENOENT, due to unexpected index state.

Reject such cases by verifying that the bitmap is not empty when index blocks exist.(CVE-2025-40067)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix fragment reassembly length accounting

batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly.

That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the intended validation and drive reassembly with inconsistent length state, leading to a local denial of service.

Fix the accounting by storing the accumulated length in a length-typed field and rejecting update overflows before the existing validation logic runs.

The fix was verified against the original reproducer and against valid fragment reassembly paths.(CVE-2026-52914)

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix listxattr handling when the buffer is full

[BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly.

kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ...

[CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode.

That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer.

[FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero.

That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.(CVE-2026-53041)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Use krealloc_array() in dal_vector_reserve()

[Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on…

Record: OESA-2026-4357
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-74408 8.8

Record: UBUNTU-CVE-2026-74408
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-10

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1791132071 No score

Fix of 159 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132071
Updated: 2026-11-02

OSVCLSA-2026-1791132078 No score

Fix of 160 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132078
Updated: 2026-11-02

OSVCLSA-2026-1791946572 No score

Fix of 198 CVEs

CVE-2024-36894
- usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
CVE-2026-97447
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
CVE-2026-93822
- PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
CVE-2026-93826
- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
CVE-2026-97954
- net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
CVE-2026-97949
- configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
CVE-2026-97931
- ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
CVE-2026-97940
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
CVE-2026-97539
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
CVE-2026-74510
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
CVE-2026-72084
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-90321
- ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-74637
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
CVE-2026-74752
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
CVE-2026-74387
- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
CVE-2026-80536
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
CVE-2026-89659
- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
CVE-2026-80576
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
CVE-2026-90223
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
CVE-2026-80994
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
CVE-2026-72398
- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
CVE-2026-74583
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
CVE-2026-72322
- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
CVE-2026-93095
- hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
CVE-2026-72472
- nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-90421
- PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
CVE-2026-64583
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
CVE-2026-68329
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
CVE-2026-89448
- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64305
- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
CVE-2026-64348
- usb: free iso schedules on failed submit {CVE-2026-64348}
CVE-2026-64422
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
CVE-2026-90180
- block:…

Record: CLSA-2026-1791946572
Updated: 2026-11-02

OSVCLSA-2026-1792234299 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792234299
Updated: 2026-11-02

OSVCLSA-2026-1792236238 No score

kernel: Fix of 74 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236238
Updated: 2026-11-02

OSVCLSA-2026-1792236273 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236273
Updated: 2026-11-02

OSVCLSA-2026-1792239979 No score

kernel: Fix of 73 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917}
bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402}
drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294}
nbd: restrict sockets to TCP and UDP {CVE-2025-40080}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
scsi: smartpqi: Fix device resources accessed after device removal {CVE-2025-68371}
cifs: fix oops during encryption {CVE-2022-50341}
net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491}
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
xfs: clean up dqblk extraction {CVE-2026-80529}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
bpf: Fix accesses to uninit stack slots {CVE-2023-52452}
bpf: Allow reads from uninit stack {CVE-2023-52452}
fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() {CVE-2023-52731}
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
net/sched: ets: use old 'nbands' while purging unused classes {CVE-2025-38684}
net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
fbcon: Fix OOB access in font allocation {CVE-2025-39967}
fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
kyber: fix out of bounds access when preempted {CVE-2021-46984}
padata: Reset next CPU when reorder sequence wraps around {CVE-2025-38584}
padata: Fix pd UAF once and for all {CVE-2025-38584}
padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
ALSA: firewire-motu: add bounds check in put_user loop for DSP events {CVE-2025-68753}
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events {CVE-2025-68347}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
PCI/ASPM:…

Record: CLSA-2026-1792239979
Updated: 2026-11-02

OSVCLSA-2026-1792749577 No score

kernel: Fix of 97 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
ice: fix double-free of tx_buf skb {CVE-2026-53009}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
sctp: prevent peer transport count overflow {CVE-2026-74469}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
nvme: add missing SRCU grace period in error path {CVE-2026-89972}
nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
fs/mbcache: cancel shrink work before destroying the…

Record: CLSA-2026-1792749577
Updated: 2026-11-02

OSVCLSA-2026-1792750763 No score

kernel: Fix of 91 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
dmaengine: Fix possible use after free {CVE-2026-72476}
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
thunderbolt: Bound root directory content to block size {CVE-2026-53149}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

Record: CLSA-2026-1792750763
Updated: 2026-11-02

OSVCLSA-2026-1792751700 No score

kernel: Fix of 106 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
SUNRPC: Fix a server shutdown leak {CVE-2023-53131}
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
wifi: mwifiex: validate scan response extents {CVE-2026-98185}
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info {CVE-2023-53066}
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count {CVE-2026-64277}
dmaengine: Fix possible use after free {CVE-2026-72476}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state {CVE-2026-93288}
mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042}
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}
usb: dwc2: Fix use after free in debug code {CVE-2026-63927}
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794}
KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
x86/mm/ident_map: Use gbpages only where full GB page should be mapped. {CVE-2024-50017}
crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508}
RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394}
dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}
net: hns3: fix kernel crash when 1588 is received on HIP08 devices {CVE-2024-26881}
ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018}
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}
fs/mbcache: cancel…

Record: CLSA-2026-1792751700
Updated: 2026-11-02

OSVCLSA-2026-1792762308 No score

kernel: Fix of 128 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066}
ASoC: Intel: avs: Disable periods-elapsed work when closing PCM {CVE-2025-40344}
ALSA: timer: drain a slave's callback before its master detaches it {CVE-2026-68201}
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams {CVE-2026-53242}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
rcu: Fix rcu_read_unlock() deadloop due to softirq {CVE-2026-45957}
bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393}
bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}
scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue {CVE-2025-37861}
scsi: csiostor: Fix dereference of null pointer rn {CVE-2026-45857}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
wifi: mwifiex: validate scan response extents {CVE-2026-98185}
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}
RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
RDMA/iwcm: Fix workqueue list corruption by removing work_list {CVE-2026-45898}
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
xprtrdma: Fix ep kref imbalance on ADDR_CHANGE {CVE-2026-72469}
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
sctp: drop a chunk if its transport was removed {CVE-2026-89478}
sctp: prevent peer transport count overflow {CVE-2026-74469}
sctp: validate embedded address parameter length {CVE-2026-74287}
sctp: revalidate list cursor after…

Record: CLSA-2026-1792762308
Updated: 2026-11-02

OSVSUSE-SU-2026:24550-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
CVE-2026-80757: selinux: reject a…

Record: SUSE-SU-2026:24550-1
Updated: 2026-11-06

OSVSUSE-SU-2026:4892-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2023-54158: btrfs: don't free qgroup space unless specified (bsc#1256076).
CVE-2023-54180: btrfs: handle case when repair happens with dev-replace (bsc#1255995).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-63948: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (bsc#1272670).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64456: hwrng: virtio: clamp device-reported used.len at copy_data() (bsc#1273288).
CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
CVE-2026-68106: drm/amdgpu: fix division by zero with invalid uvd dimensions (bsc#1274853).
CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
CVE-2026-68236: drm/amd/display: set new_stream to NULL after release (bsc#1275659).
CVE-2026-68303: drm/vc4: hvs/v3d: Fix null dereference in unbind (bsc#1275080).
CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
CVE-2026-68430: drm/amdgpu/gfx8: drop unecessary BUG_ON() (bsc#1276273).
CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
CVE-2026-72319: ipvs: ensure inner headers in ICMP errors are in headroom (bsc#1275964).
CVE-2026-72476: dmaengine: Fix possible use after free (bsc#1276844).
CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
CVE-2026-74408: wifi: ath9k: fix OOB access from firmware tx status queue ID (bsc#1276387).
CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
CVE-2026-74675: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (bsc#1278313).
CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
CVE-2026-89726: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (bsc#1281058).
CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
CVE-2026-93252: ocfs2: make ocfs2_set_acl() static (bsc#1282784).
CVE-2026-93287: i2c: smbus: reject oversized block transfers in the common path (bsc#1282744).
CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
CVE-2026-93820: PCI: rockchip: Protect root bus removal with rescan lock (bsc#1282755).
CVE-2026-93822: PCI: iproc: Protect root bus removal with rescan lock (bsc#1282762).
CVE-2026-97416: btrfs: balance: fix potential…

Record: SUSE-SU-2026:4892-1
Updated: 2026-11-02

OSVSUSE-SU-2026:5091-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
CVE-2026-80879: ocfs2: fix circular locking dependency…

Record: SUSE-SU-2026:5091-1
Updated: 2026-11-04

OSVUSN-8781-1 No score

linux-nvidia-tegra vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)