opensuse/kernel-azure&distro=openSUSE Leap 16.0

Vulnerabilities (643)

• CVE-2026-23137Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: of: unittest: Fix memory leak in unittest_data_add() In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cl

• CVE-2026-23135Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dma_free_coherent() pointer dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the

• CVE-2026-23133Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: fix dma_free_coherent() pointer dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields. Those should be reused when freeing the buffer rather than the

• CVE-2026-23131Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names The hp-bioscfg driver attempts to register kobjects with empty names when the HP BIOS returns attributes with empty name strings. This ca

• CVE-2026-23129Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: dpll: Prevent duplicate registrations Modify the internal registration helpers dpll_xa_ref_{dpll,pin}_add() to reject duplicate registration attempts. Previously, if a caller attempted to register the same pin

• CVE-2026-23128Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not ha

• CVE-2026-23125Feb 14, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails: ===============================================

• CVE-2026-23123Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: interconnect: debugfs: initialize src_node and dst_node to empty strings The debugfs_create_str() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer unin

• CVE-2026-23121Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: mISDN: annotate data-race around dev->work dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations. BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read write

• CVE-2026-23120Feb 14, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: l2tp: avoid one data-race in l2tp_tunnel_del_work() We should read sk->sk_socket only when dealing with kernel sockets. syzbot reported the following data-race: BUG: KCSAN: data-race in l2tp_tunnel_del_work /

• CVE-2026-23119Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: bonding: provide a net pointer to __skb_flow_dissect() After 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") we have to provide a net pointer to __skb_flow_dissect(), either via skb->dev,

• CVE-2026-23116Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu For i.MX8MQ platform, the ADB in the VPUMIX domain has no separate reset and clock enable bits, but is ungated and reset together with the

• CVE-2025-71200Feb 14, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MS

• CVE-2026-23112CriFeb 13, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading

• CVE-2026-23111HigFeb 13, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate()

• CVE-2026-23110MedFeb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Wake up the error handler when final completions race against each other The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running

• CVE-2026-23105HigFeb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qle

• CVE-2026-23103HigFeb 4, 2026
  affected < 6.12.0-160000.28.1fixed 6.12.0-160000.28.1

  In the Linux kernel, the following vulnerability has been resolved: ipvlan: Make the addrs_lock be per port Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so

• CVE-2026-23100MedFeb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb_pmd_shared() Patch series "mm/hugetlb: fixes for PMD table sharing (incl. using mmu_gather)", v3. One functional fix, one performance regression fix, and two related comment fixes. I

• CVE-2026-23095HigFeb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in