CVE-2026-80782

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-99999
  • ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• CVE-2025-39945
  • cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• CVE-2022-50315
  • ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• CVE-2025-38459
  • atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• CVE-2025-38323
  • net: atm: add lec_mutex {CVE-2025-38323}
• CVE-2026-97540
  • net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-98077
  • netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• CVE-2026-97608
  • netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• CVE-2026-97564
  • smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• CVE-2023-54213
  • USB: sisusbvga: Add endpoint checks {CVE-2023-54213}
• CVE-2026-80757
  • selinux: reject a class permission count below its inherited common {CVE-2026-80757}
• CVE-2026-89865
  • scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865}
• CVE-2026-89843
  • scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843}
• CVE-2026-80782
  • HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782}
• CVE-2026-90056
  • net: fec: only stop PTP if it was initialized {CVE-2026-90056}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2022-50776
  • clk: st: Fix memory leak in st_of_quadfs_setup() {CVE-2022-50776}
• CVE-2026-80798
  • nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798}
• CVE-2026-93061
  • gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-90345
  • wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
• CVE-2026-80794
  • nfc: nci: fix uninit-value in the RF discover/activated NTF handlers {CVE-2026-80794}
• CVE-2026-80793
  • ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-63933
  • iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933}
• CVE-2026-80742
  • af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}
• CVE-2026-90104
  • NFSv4.1: zero referring call lists before decoding {CVE-2026-90104}
• CVE-2026-90335
  • tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• CVE-2026-90336
  • serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2024-50076
  • vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}
• CVE-2022-50641
  • HSI: omap_ssi: Fix refcount leak in ssi_probe {CVE-2022-50641}
• CVE-2026-80797
  • nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797}
• CVE-2026-89982
  • i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982}
• CVE-2026-80733
  • net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733}
• CVE-2026-90068
  • ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-93141
  • usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141}
• CVE-2026-90088 -…

• can: esd_usb: kill anchored URBs before freeing netdevs {CVE-2026-64585}
• ext4: fix kernel BUG in ext4_write_inline_data_end {CVE-2026-74308}
• netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop {CVE-2026-72348}
• xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() {CVE-2026-64580}
• platform/x86: dell-laptop: fix missing cleanups in init error path {CVE-2026-72144}
• ALSA: seq: Clear variable event pointer on read {CVE-2026-74339}
• netfilter: xt_cluster: reject template conntracks in hash match {CVE-2026-72256}
• net/sched: cls_flow: Dont expose folded kernel pointers {CVE-2026-74290}
• mfd: sm501: Fix reference leak on failed device registration {CVE-2026-72240}
• net: atm: reject out-of-range traffic classes in QoS validation {CVE-2026-72297}
• ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser {CVE-2026-64487}
• scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker {CVE-2026-63890}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• isofs: release zisofs block pointer buffer head {CVE-2026-90434}
• HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• fat: release buffer head after rebuilding parent {CVE-2026-90318}
• wifi: mac80211: ibss: wait for in-flight TX on disconnect {CVE-2026-93804}
• wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336}
• locking/lockdep: Fix NULL pointer dereference in __lock_set_class() {CVE-2026-93261}
• smb: client: reject short READ responses in CIFSSMBRead() {CVE-2026-97565}
• UDF symlink pathComponent header OOB read {CVE-2026-93055}
• ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
• RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108}
• cifs: call pagecache_isize_extended() in cifs_setsize() when extending {CVE-2026-89642}
• nfsd: release path refs on follow_down() error {CVE-2026-89707}
• HID: roccat: free buffered reports when destroying device {CVE-2026-89627}
• NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987}
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949}
• svcrdma: Reject connection when transport allocation fails {CVE-2026-89531}
• xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}
• sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890}
• SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails {CVE-2022-50821}
• ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• mtd: Fix device name leak when register device failed in add_mtd_device() {CVE-2022-50566}
• virtio_console: eliminate anonymous module_init & module_exit {CVE-2022-49100}
• mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) {CVE-2022-49077}
• lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484}
• mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}
• wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• acct: fix potential integer overflow in encode_comp_t() {CVE-2022-50749}
• media: dvb-frontends: fix leak of memory fw {CVE-2022-50664}
• usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830}
• rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814}
• udf: reject VAT indexes equal to the entry count {CVE-2026-89525}
• lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726}
• ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649}
• bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582}
• SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551}
• sctp: stop processing a packet once its association is deleted {CVE-2026-89479}
• ALSA: aloop: Check card index…

• can: esd_usb: kill anchored URBs before freeing netdevs {CVE-2026-64585}
• ext4: fix kernel BUG in ext4_write_inline_data_end {CVE-2026-74308}
• netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop {CVE-2026-72348}
• xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() {CVE-2026-64580}
• platform/x86: dell-laptop: fix missing cleanups in init error path {CVE-2026-72144}
• ALSA: seq: Clear variable event pointer on read {CVE-2026-74339}
• netfilter: xt_cluster: reject template conntracks in hash match {CVE-2026-72256}
• net/sched: cls_flow: Dont expose folded kernel pointers {CVE-2026-74290}
• mfd: sm501: Fix reference leak on failed device registration {CVE-2026-72240}
• net: atm: reject out-of-range traffic classes in QoS validation {CVE-2026-72297}
• ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser {CVE-2026-64487}
• scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker {CVE-2026-63890}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• isofs: release zisofs block pointer buffer head {CVE-2026-90434}
• HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• fat: release buffer head after rebuilding parent {CVE-2026-90318}
• wifi: mac80211: ibss: wait for in-flight TX on disconnect {CVE-2026-93804}
• wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336}
• locking/lockdep: Fix NULL pointer dereference in __lock_set_class() {CVE-2026-93261}
• smb: client: reject short READ responses in CIFSSMBRead() {CVE-2026-97565}
• UDF symlink pathComponent header OOB read {CVE-2026-93055}
• ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
• RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108}
• cifs: call pagecache_isize_extended() in cifs_setsize() when extending {CVE-2026-89642}
• nfsd: release path refs on follow_down() error {CVE-2026-89707}
• HID: roccat: free buffered reports when destroying device {CVE-2026-89627}
• NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987}
• wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949}
• svcrdma: Reject connection when transport allocation fails {CVE-2026-89531}
• xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843}
• sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890}
• SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails {CVE-2022-50821}
• ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• mtd: Fix device name leak when register device failed in add_mtd_device() {CVE-2022-50566}
• virtio_console: eliminate anonymous module_init & module_exit {CVE-2022-49100}
• mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) {CVE-2022-49077}
• lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484}
• mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974}
• wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• acct: fix potential integer overflow in encode_comp_t() {CVE-2022-50749}
• media: dvb-frontends: fix leak of memory fw {CVE-2022-50664}
• usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830}
• rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814}
• udf: reject VAT indexes equal to the entry count {CVE-2026-89525}
• lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726}
• ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649}
• bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582}
• SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551}
• sctp: stop processing a packet once its association is deleted {CVE-2026-89479}
• ALSA: aloop: Check card index…

In the Linux kernel, the following vulnerability has been resolved:

HID: magicmouse: do not keep a stale msc->input if no input is claimed

magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered.

That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input.

The failure does not abort the probe. hid_connect() only skips the claim:

if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev,
			connect_mask & HID_CONNECT_HIDINPUT_FORCE))
	hdev->claimed |= HID_CLAIMED_INPUT;

and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory.

Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well.

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered. That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input. The failure does not abort the probe. hid_connect() only skips the claim: if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev, connect_mask & HID_CONNECT_HIDINPUT_FORCE)) hdev->claimed |= HID_CLAIMED_INPUT; and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory. Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well.

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-7.2.5-1.1 package on the GA media of openSUSE Tumbleweed.

In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered. That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input. The failure does not abort the probe. hid_connect() only skips the claim: if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev, connect_mask & HID_CONNECT_HIDINPUT_FORCE)) hdev->claimed |= HID_CLAIMED_INPUT; and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory. Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…