CVE-2026-89953

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2022-49416
  • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• CVE-2022-49685
  • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
• CVE-2021-47670
  • can: peak_usb: fix use after free bugs {CVE-2021-47670}
• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98579
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
• CVE-2026-98581
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
  • netlink: use blocking notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98829
  • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
• CVE-2026-98708
  • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
• CVE-2026-98707
  • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98461
  • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98739
  • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98856
  • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98681
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98696
  • USB: serial: fix driver deregistration order {CVE-2026-98696}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in …

In the Linux kernel, the following vulnerability has been resolved:

mtd: mtdoops: free page bitmap when the backing MTD is removed

mtdoops_notify_add() allocates oops_page_used when the configured MTD device is registered. mtdoops_notify_remove() detaches from that device but leaves the bitmap allocated. If the same MTD device is later registered again, the add path allocates a new bitmap and overwrites the old pointer, leaking one vmalloc allocation per remove/add cycle.

This is only visible when the backing MTD device can disappear and be registered again while mtdoops remains loaded, so the usual static MTD case does not expose it.

Free the bitmap after unregistering the dumper and flushing the pending workers, then clear the pointer and page count before a later attach can allocate fresh state. Clearing the pointer also keeps the module exit path from freeing the same bitmap a second time after a remove event.

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoops_notify_add() allocates oops_page_used when the configured MTD device is registered. mtdoops_notify_remove() detaches from that device but leaves the bitmap allocated. If the same MTD device is later registered again, the add path allocates a new bitmap and overwrites the old pointer, leaking one vmalloc allocation per remove/add cycle. This is only visible when the backing MTD device can disappear and be registered again while mtdoops remains loaded, so the usual static MTD case does not expose it. Free the bitmap after unregistering the dumper and flushing the pending workers, then clear the pointer and page count before a later attach can allocate fresh state. Clearing the pointer also keeps the module exit path from freeing the same bitmap a second time after a remove event.

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-7.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
• CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
• CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
• CVE-2026-80879: ocfs2: fix circular locking dependency…

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdoops: free page bitmap when the backing MTD is removed mtdoops_notify_add() allocates oops_page_used when the configured MTD device is registered. mtdoops_notify_remove() detaches from that device but leaves the bitmap allocated. If the same MTD device is later registered again, the add path allocates a new bitmap and overwrites the old pointer, leaking one vmalloc allocation per remove/add cycle. This is only visible when the backing MTD device can disappear and be registered again while mtdoops remains loaded, so the usual static MTD case does not expose it. Free the bitmap after unregistering the dumper and flushing the pending workers, then clear the pointer and page count before a later attach can allocate fresh state. Clearing the pointer also keeps the module exit path from freeing the same bitmap a second time after a remove event.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…