CVE-2026-74641

ALSA: usx2y: bound the hwdep mmap fault offset

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

snd_us428ctls_mmap() checks only the length of the mapping, never the offset, and us428ctls_sharedmem is a single page from alloc_pages_exact(). For a character device file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page offset above zero resolves to a struct page outside the object, and the handler installs it into the caller's address space read-write; the vma is not marked read-only.

The caller picks the page frame with a single mmap() argument and gets read-write access to a page of kernel memory it does not own; an offset that lands in an unpopulated vmemmap region oopses instead.

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Unable to handle kernel paging request at virtual address fffffdffc45d5ac8 pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] Call trace: snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] __do_fault __handle_mm_fault handle_mm_fault el0_da

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Down 0.1 points since Aug 23, 2026

What each source reports

CVE List Score used 7.8

ALSA: usx2y: bound the hwdep mmap fault offset

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Record: CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-64578 7.8

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Record: EUVD-2026-64578
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mrvc-mw2v-9ww4 7.8

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep...

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Record: GHSA-mrvc-mw2v-9ww4
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Record: CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-74641 7.8

Record: BELL-CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

ALSA: usx2y: bound the hwdep mmap fault offset

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usx2y: bound the hwdep mmap fault offset

snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind:

offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;

return 0;

A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved.

On 7.2.0-rc5 (arm64), mmap() with a large offset:

Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound.

Discovered by XBOW, triaged by Baul Lee [email protected]

Record: CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

Show 43 moreShow less

OSVDEBIAN-CVE-2026-74641 7.8

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf->pgoff << PAGE_SHIFT; vaddr = (char *)(...)->us428ctls_sharedmem + offset; page = virt_to_page(vaddr); get_page(page); vmf->page = page; return 0; snd_us428ctls_mmap() checks only the length of the mapping, never the offset, and us428ctls_sharedmem is a single page from alloc_pages_exact(). For a character device file_mmap_size_max() returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page offset above zero resolves to a struct page outside the object, and the handler installs it into the caller's address space read-write; the vma is not marked read-only. The caller picks the page frame with a single mmap() argument and gets read-write access to a page of kernel memory it does not own; an offset that lands in an unpopulated vmemmap region oopses instead. A process that can open the hwdep node of an attached US-X2Y reaches this after loading the FPGA image through the same node; no capability check is involved. On 7.2.0-rc5 (arm64), mmap() with a large offset: Unable to handle kernel paging request at virtual address fffffdffc45d5ac8 pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] Call trace: snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y] __do_fault __handle_mm_fault handle_mm_fault el0_da Reject any offset outside the shared region. The pcm hwdep handler in usx2yhwdeppcm.c computes its address the same way and needs the same bound. Discovered by XBOW, triaged by Baul Lee [email protected]

Record: DEBIAN-CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83156 8.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:83156
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83157 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:83157
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83159 8.8

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Record: RHSA-2026:83159
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83207 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:83156 8.8

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83156
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83157 8.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83157
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83159 8.8

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83159
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83207 8.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-74641 7.8

Record: UBUNTU-CVE-2026-74641
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVALSA-2026:83156 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83156
Updated: 2026-11-02

OSVALSA-2026:83157 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83157
Updated: 2026-11-02

OSVALSA-2026:83159 No score

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83159
Updated: 2026-11-02

OSVALSA-2026:83207 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83207
Updated: 2026-11-02

OSVCLSA-2026-1789037015 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789037015
Updated: 2026-11-02

OSVCLSA-2026-1789039259 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789039259
Updated: 2026-11-02

OSVCLSA-2026-1789039867 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789039867
Updated: 2026-11-02

OSVCLSA-2026-1789141176 No score

kernel: Fix of 131 CVEs

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
net_sched: red: fix a race in __red_change() {CVE-2025-38108}
iio: event: Fix event FIFO reset race {CVE-2026-64496}
netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

Record: CLSA-2026-1789141176
Updated: 2026-11-02

OSVCLSA-2026-1789898700 No score

kernel: Fix of 163 CVEs

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
xfs: close crash window in attr dabtree…

Record: CLSA-2026-1789898700
Updated: 2026-11-02

OSVCLSA-2026-1791800936 No score

kernel: Fix of 191 CVEs

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
proc: Fix broken error paths for namespace links {CVE-2026-64371}
proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
bpf: Allow LPM map access from sleepable…

Record: CLSA-2026-1791800936
Updated: 2026-11-02

OSVCLSA-2026-1791858923 No score

Fix of 174 CVEs

CVE-2026-90205
- ocfs2: validate orphan slot during inode read {CVE-2026-90205}
CVE-2026-93054
- uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
CVE-2026-93103
- RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-89878
- media: s2255: check firmware size before reading trailing marker {CVE-2026-89878}
CVE-2026-90037
- NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037}
CVE-2026-90296
- cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296}
CVE-2026-90415
- RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
CVE-2026-90081
- net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081}
CVE-2026-90420
- nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420}
CVE-2026-90116
- ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
CVE-2026-90070
- tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
CVE-2026-89845
- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
CVE-2026-89944
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure {CVE-2026-89944}
CVE-2026-90018
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() {CVE-2026-90018}
CVE-2026-89860
- scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860}
CVE-2026-90007
- scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007}
CVE-2026-90044
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}
CVE-2026-68289
- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
CVE-2026-90143
- net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
CVE-2026-90111
- ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111}
CVE-2026-90283
- hugetlbfs: release subpool on fill_super failure {CVE-2026-90283}
CVE-2026-92521
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
CVE-2026-93048
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
CVE-2026-93160
- crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160}
CVE-2026-93199
- i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199}
CVE-2026-89953
- mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89937
- iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937}
CVE-2026-89993
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs {CVE-2026-89993}
CVE-2026-89972
- nvme: add missing SRCU grace period in error path {CVE-2026-89972}
CVE-2026-89892
- media: em28xx: defer audio-only extension registration {CVE-2026-89892}
CVE-2026-90023
- usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023}
CVE-2026-90020
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
CVE-2026-90017
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017}
CVE-2026-90016
- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}
CVE-2026-90329
- HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} *…

Record: CLSA-2026-1791858923
Updated: 2026-11-02

OSVCLSA-2026-1791876326 No score

Fix of 274 CVEs

CVE-2026-53091
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
CVE-2026-93803
- wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
CVE-2026-93286
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
CVE-2026-93280
- greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
CVE-2026-93213
- of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
CVE-2026-93802
- wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
CVE-2026-93206
- PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
CVE-2026-97448
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
CVE-2026-97408
- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
CVE-2026-93268
- ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
CVE-2026-93782
- vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
CVE-2026-93783
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
CVE-2026-97455
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
CVE-2026-93807
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
CVE-2026-93808
- ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
CVE-2026-89938
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
CVE-2026-89927
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
CVE-2026-89949
- batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
CVE-2026-89912
- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
CVE-2026-89932
- KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-89854
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-89979
- ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
CVE-2026-89852
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
CVE-2026-89861
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
CVE-2026-89859
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
CVE-2026-90036
- NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
CVE-2026-89987
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
CVE-2026-89799
- bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
CVE-2026-90032
- media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89929
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
CVE-2026-89840
- f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
CVE-2026-89913
- KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

Record: CLSA-2026-1791876326
Updated: 2026-11-02

OSVCLSA-2026-1791878869 No score

Fix of 274 CVEs

CVE-2026-53091
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
CVE-2026-93803
- wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
CVE-2026-93286
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
CVE-2026-93280
- greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
CVE-2026-93213
- of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
CVE-2026-93802
- wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
CVE-2026-93206
- PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
CVE-2026-97448
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
CVE-2026-97408
- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
CVE-2026-93268
- ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
CVE-2026-93782
- vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
CVE-2026-93783
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
CVE-2026-97455
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
CVE-2026-93807
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
CVE-2026-93808
- ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
CVE-2026-89938
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
CVE-2026-89927
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
CVE-2026-89949
- batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
CVE-2026-89912
- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
CVE-2026-89932
- KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-89854
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-89979
- ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
CVE-2026-89852
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
CVE-2026-89861
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
CVE-2026-89859
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
CVE-2026-90036
- NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
CVE-2026-89987
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
CVE-2026-89799
- bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
CVE-2026-90032
- media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89929
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
CVE-2026-89840
- f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
CVE-2026-89913
- KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

Record: CLSA-2026-1791878869
Updated: 2026-11-02

OSVCLSA-2026-1791946572 No score

Fix of 198 CVEs

CVE-2024-36894
- usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
CVE-2026-97447
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
CVE-2026-93822
- PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
CVE-2026-93826
- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
CVE-2026-97954
- net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
CVE-2026-97949
- configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
CVE-2026-97931
- ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
CVE-2026-97940
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
CVE-2026-97539
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
CVE-2026-74510
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
CVE-2026-72084
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-90321
- ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-74637
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
CVE-2026-74752
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
CVE-2026-74387
- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
CVE-2026-80536
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
CVE-2026-89659
- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
CVE-2026-80576
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
CVE-2026-90223
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
CVE-2026-80994
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
CVE-2026-72398
- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
CVE-2026-74583
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
CVE-2026-72322
- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
CVE-2026-93095
- hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
CVE-2026-72472
- nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-90421
- PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
CVE-2026-64583
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
CVE-2026-68329
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
CVE-2026-89448
- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64305
- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
CVE-2026-64348
- usb: free iso schedules on failed submit {CVE-2026-64348}
CVE-2026-64422
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
CVE-2026-90180
- block:…

Record: CLSA-2026-1791946572
Updated: 2026-11-02

OSVCLSA-2026-1791949745 No score

kernel: Fix of 69 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1791949745
Updated: 2026-11-02

OSVCLSA-2026-1792020435 No score

kernel: Fix of 68 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1792020435
Updated: 2026-11-02

OSVCLSA-2026-1792243729 No score

kernel: Fix of 53 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
Squashfs: check block offset is not negative {CVE-2026-90203}
tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
isdn: cpai: check ctr->cnr…

Record: CLSA-2026-1792243729
Updated: 2026-11-02

OSVCLSA-2026-1792247642 No score

kernel: Fix of 50 CVEs

ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}
dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}
net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
Squashfs: check block offset is not negative {CVE-2026-90203}
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
ALSA: 6fire: fix use-after-free on disconnect…

Record: CLSA-2026-1792247642
Updated: 2026-11-02

OSVMGASA-2026-0506 No score

Updated kernel, drakx-installer-images, kmod-nvidia-current-wopengpu, kmod-xtables-addons & kmod-virtualbox packages fix Security Vulnerabilities

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0506
Updated: 2026-11-02

OSVMGASA-2026-0542 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0542
Updated: 2026-11-02

OSVSUSE-SU-2026:24550-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
CVE-2026-80757: selinux: reject a…

Record: SUSE-SU-2026:24550-1
Updated: 2026-11-06

OSVSUSE-SU-2026:4639-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
CVE-2026-68376: sctp: patch over auth_hmacs copy overflow (bsc#1274836).
CVE-2026-72083: target: fix double unmap data sg in core_scsi3_emulate_pro_register_and_move() (bsc#1275535).
CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).

The following non security issue was fixed:

Disable BATMAN in supported.conf
Disable CONFIG_BATMAN_ADV (jsc#PED-16892)
Disable CONFIG_CAN (jsc#PED-17000)

Record: SUSE-SU-2026:4639-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4687-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). -…

Record: SUSE-SU-2026:4687-1
Updated: 2026-11-02

OSVSUSE-SU-2026:5091-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
CVE-2026-80879: ocfs2: fix circular locking dependency…

Record: SUSE-SU-2026:5091-1
Updated: 2026-11-04

OSVUSN-8875-1 No score

linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)