CVE-2026-81001

slip: fix use-after-free in sl_sync()

7.8 HighFix available

What does this mean?

: 7.8v3.1, from CVE List
: 0.16%5th percentile
Fixed in: 6.1.189-r0linux-lts
Published: September 11, 2026
Modified: November 6, 2026
Also known as: BELL-CVE-2026-81001CLSA-2026-1791132991CLSA-2026-1791876326CLSA-2026-1791878869CLSA-2026-1791946572CLSA-2026-1791949745CLSA-2026-1792020435CLSA-2026-1792234299
Show 27 moreShow less
CLSA-2026-1792236238CLSA-2026-1792236273CLSA-2026-1792419819DEBIAN-CVE-2026-81001EUVD-2026-76324GHSA-pxg4-rg6h-vm8pOESA-2026-4591SUSE-SU-2026:24179-1SUSE-SU-2026:24181-1SUSE-SU-2026:24182-1SUSE-SU-2026:24184-1SUSE-SU-2026:24197-1SUSE-SU-2026:24235-1SUSE-SU-2026:24315-1SUSE-SU-2026:24316-1SUSE-SU-2026:4640-1SUSE-SU-2026:4687-1SUSE-SU-2026:4706-1UBUNTU-CVE-2026-81001USN-8959-1USN-8960-1USN-8961-1USN-8962-1USN-8963-1USN-9002-1openSUSE-SU-2026:11880-1openSUSE-SU-2026:22091-1

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor.

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device:

CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed / sl = netdev_priv(dev) if (sl->tty || sl->leased) / use-after-free */

BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506

CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712

Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564

Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860

Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it.

Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.16%Unchanged since Sep 12, 2026

What each source reports

CVE List Score used 7.8

slip: fix use-after-free in sl_sync()

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

Record: CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-76324 7.8

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

Record: EUVD-2026-76324
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pxg4-rg6h-vm8p 7.8

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in...

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

Record: GHSA-pxg4-rg6h-vm8p
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

Record: CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-81001 7.8

Record: BELL-CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

slip: fix use-after-free in sl_sync()

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
	if (dev->priv_destructor)
		dev->priv_destructor(dev);	/* slip_devs[i] = NULL */
	if (dev->needs_free_netdev)
		free_netdev(dev);
	...
	/* Free network device */
	kobject_put(&dev->dev.kobj);

Record: CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 32 moreShow less

OSVDEBIAN-CVE-2026-81001 7.8

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests / list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); / slip_devs[i] = NULL / if (dev->needs_free_netdev) free_netdev(dev); ... / Free network device / kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) / dev is freed / sl = netdev_priv(dev) if (sl->tty || sl->leased) / use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---

Record: DEBIAN-CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4591 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.(CVE-2025-40233)

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: properly keep track of conduit reference

Problem description

DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense.

There are two distinct problems.

The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch:

(unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind

we see these lines in the output diff which appear only with the patch applied:

kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)

After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()).

Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it.

So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference.

Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see…

Record: OESA-2026-4591
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-81001 7.8

Record: UBUNTU-CVE-2026-81001
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVCLSA-2026-1791132991 No score

Fix of 400 CVEs

CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-39827
- net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
CVE-2026-93140
- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
CVE-2026-90112
- net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
CVE-2026-90237
- netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
CVE-2026-93051
- misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
CVE-2026-90379
- wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90383
- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-93047
- drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
CVE-2026-93192
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
CVE-2026-93050
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
CVE-2026-90311
- thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
CVE-2026-93191
- smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
CVE-2026-93042
- dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
CVE-2026-93056
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
CVE-2026-93203
- batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
CVE-2026-93204
- batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
CVE-2026-90000
- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-93202
- i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
CVE-2026-90347
- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
CVE-2026-90267
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
CVE-2026-92500
- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
CVE-2026-93196
- nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
CVE-2026-90207
- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
CVE-2026-90307
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
CVE-2026-90110
- inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
CVE-2026-90293
- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
CVE-2026-89838
- f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
CVE-2026-93177
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
CVE-2026-89823
- drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
CVE-2026-90041
- HID: sony: clean up device list on probe failure {CVE-2026-90041}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-93095 -…

Record: CLSA-2026-1791132991
Updated: 2026-11-02

OSVCLSA-2026-1791876326 No score

Fix of 274 CVEs

CVE-2026-53091
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
CVE-2026-93803
- wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
CVE-2026-93286
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
CVE-2026-93280
- greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
CVE-2026-93213
- of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
CVE-2026-93802
- wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
CVE-2026-93206
- PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
CVE-2026-97448
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
CVE-2026-97408
- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
CVE-2026-93268
- ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
CVE-2026-93782
- vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
CVE-2026-93783
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
CVE-2026-97455
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
CVE-2026-93807
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
CVE-2026-93808
- ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
CVE-2026-89938
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
CVE-2026-89927
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
CVE-2026-89949
- batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
CVE-2026-89912
- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
CVE-2026-89932
- KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-89854
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-89979
- ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
CVE-2026-89852
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
CVE-2026-89861
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
CVE-2026-89859
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
CVE-2026-90036
- NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
CVE-2026-89987
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
CVE-2026-89799
- bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
CVE-2026-90032
- media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89929
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
CVE-2026-89840
- f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
CVE-2026-89913
- KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

Record: CLSA-2026-1791876326
Updated: 2026-11-02

OSVCLSA-2026-1791878869 No score

Fix of 274 CVEs

CVE-2026-53091
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
CVE-2026-93803
- wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
CVE-2026-93286
- net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
CVE-2026-93280
- greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
CVE-2026-93213
- of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
CVE-2026-93802
- wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
CVE-2026-93206
- PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
CVE-2026-97448
- ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
CVE-2026-97408
- Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
CVE-2026-93268
- ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
CVE-2026-93782
- vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
CVE-2026-93783
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
CVE-2026-97455
- ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
CVE-2026-93807
- wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
CVE-2026-93808
- ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
CVE-2026-89938
- iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
CVE-2026-89927
- KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
CVE-2026-89949
- batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
CVE-2026-89912
- KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
CVE-2026-89932
- KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-89854
- scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-89979
- ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
CVE-2026-89852
- scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
CVE-2026-89861
- scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
CVE-2026-89859
- scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
CVE-2026-90036
- NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
CVE-2026-89987
- mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
CVE-2026-89799
- bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
CVE-2026-90032
- media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89929
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
CVE-2026-89840
- f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
CVE-2026-89913
- KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

Record: CLSA-2026-1791878869
Updated: 2026-11-02

OSVCLSA-2026-1791946572 No score

Fix of 198 CVEs

CVE-2024-36894
- usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
CVE-2026-97447
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
CVE-2026-93822
- PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
CVE-2026-93826
- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
CVE-2026-97954
- net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
CVE-2026-97949
- configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
CVE-2026-97931
- ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
CVE-2026-97940
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
CVE-2026-97539
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
CVE-2026-74510
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
CVE-2026-72084
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-90321
- ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-74637
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
CVE-2026-74752
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
CVE-2026-74387
- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
CVE-2026-80536
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
CVE-2026-89659
- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
CVE-2026-80576
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
CVE-2026-90223
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
CVE-2026-80994
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
CVE-2026-72398
- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
CVE-2026-74583
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
CVE-2026-72322
- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
CVE-2026-93095
- hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
CVE-2026-72472
- nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-90421
- PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
CVE-2026-64583
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
CVE-2026-68329
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
CVE-2026-89448
- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64305
- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
CVE-2026-64348
- usb: free iso schedules on failed submit {CVE-2026-64348}
CVE-2026-64422
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
CVE-2026-90180
- block:…

Record: CLSA-2026-1791946572
Updated: 2026-11-02

OSVCLSA-2026-1791949745 No score

kernel: Fix of 69 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1791949745
Updated: 2026-11-02

OSVCLSA-2026-1792020435 No score

kernel: Fix of 68 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1792020435
Updated: 2026-11-02

OSVCLSA-2026-1792234299 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792234299
Updated: 2026-11-02

OSVCLSA-2026-1792236238 No score

kernel: Fix of 74 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236238
Updated: 2026-11-02

OSVCLSA-2026-1792236273 No score

kernel: Fix of 76 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
Squashfs: check block offset is not negative {CVE-2026-90203}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
dm array: validate array block headers on read {CVE-2026-89574}
nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
dmaengine: Fix possible use after free {CVE-2026-72476}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
sctp: validate embedded address parameter length {CVE-2026-74287}
netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
nvmet-rdma: handle inline…

Record: CLSA-2026-1792236273
Updated: 2026-11-02

OSVCLSA-2026-1792419819 No score

Fix of 74 CVEs

Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-*, distinct from the prior 4.19.0-29.
CVE-2021-3493
- vfs: move cap_convert_nscap() call into vfs_setxattr() {CVE-2021-3493}
- ecryptfs: fix uid translation for setxattr on security.capability {CVE-2021-3493}
CVE-2025-23142
- sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
CVE-2025-38352
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-52955
- libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
CVE-2026-53091
- net: account for encap headers in qdisc pkt len {CVE-2026-53091}
- xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2026-63814
- f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}
CVE-2026-63815
- f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815}
CVE-2026-63922
- ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
CVE-2026-63962
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64009
- xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
CVE-2026-64011
- nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}
CVE-2026-64372
- cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
CVE-2026-64378
- writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
- writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
CVE-2026-64381
- smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}
CVE-2026-64471
- Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
CVE-2026-64483
- ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
CVE-2026-64504
- iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504}
CVE-2026-64505
- usb: gadget: function: rndis: add length check for header {CVE-2026-64505}
CVE-2026-64541
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541}
CVE-2026-64543
- tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}
CVE-2026-64546
- drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
CVE-2026-64563
- rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
CVE-2026-64564
- sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
CVE-2026-72389
- bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
CVE-2026-74444
- drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
CVE-2026-74454
- drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454}
CVE-2026-74469
- sctp: prevent peer transport count overflow {CVE-2026-74469}
CVE-2026-74479
- net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
CVE-2026-74498
- ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
CVE-2026-74499
- ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() …

Record: CLSA-2026-1792419819
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11880-1 No score

kernel-devel-7.2.7-1.1 on GA media

These are all security issues fixed in the kernel-devel-7.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11880-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22091-1 No score