CVE-2026-90418

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

• CVE-2022-49416
  • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• CVE-2022-49685
  • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
• CVE-2021-47670
  • can: peak_usb: fix use after free bugs {CVE-2021-47670}
• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98579
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
• CVE-2026-98581
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
  • netlink: use blocking notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98829
  • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
• CVE-2026-98708
  • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
• CVE-2026-98707
  • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98461
  • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98739
  • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98856
  • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98681
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98696
  • USB: serial: fix driver deregistration order {CVE-2026-98696}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in …

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status.

This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode.

Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status. This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode. Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

These are all security issues fixed in the kernel-devel-7.2.8-1.1 package on the GA media of openSUSE Tumbleweed.

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status. This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode. Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…