opensuse/kernel-azure&distro=openSUSE Leap 16.0

Vulnerabilities (643)

• CVE-2026-23042Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: idpf: fix aux device unplugging when rdma is not supported by vport If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not allocate vdev_info for this vport. This leads to kernel NULL pointe

• CVE-2025-71192Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fails, put_device() is the correct way to drop the device reference. kfree() is not required. Add kfree() if idr_alloc() fai

• CVE-2026-23108Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In usb_8dev_open() -> u

• CVE-2026-23107Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can p

• CVE-2026-23104Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: ice: fix devlink reload call trace Commit 4da71a77fc3b ("ice: read internal temperature sensor") introduced internal temperature sensor reading via HWMON. ice_hwmon_init() was added to ice_init_feature() and ic

• CVE-2026-23102Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read fr

• CVE-2026-23101Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work

• CVE-2026-23099Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: bonding: limit BOND_MODE_8023AD to Ethernet devices BOND_MODE_8023AD makes sense for ARPHRD_ETHER only. syzbot reported: BUG: KASAN: global-out-of-bounds in __hw_addr_create net/core/dev_addr_lists.c:63 [inl

• CVE-2026-23097Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Hol

• CVE-2026-23096Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: uacce: fix cdev handling in the cleanup path When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the retu

• CVE-2026-23094Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: uacce: fix isolate sysfs check condition uacce supports the device isolation feature. If the driver implements the isolate_err_threshold_read and isolate_err_threshold_write callback functions, uacce will creat

• CVE-2026-23091Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). Note that a recent commit fixed the leak in

• CVE-2026-23090Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: slimbus: core: fix device reference leak on report present Slimbus devices can be allocated dynamically upon reception of report-present messages. Make sure to drop the reference taken when looking up already

• CVE-2026-23089Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems but the controls already added to the card still reference the freed mem

• CVE-2026-23088Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash on synthetic stacktrace field usage When creating a synthetic event based on an existing synthetic event that had a stacktrace field and the new synthetic event used that field a kernel crash

• CVE-2026-23086Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host s

• CVE-2026-23085Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as

• CVE-2026-23084Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is set to false, the driver may request the PMAC_ID from the firmware of

• CVE-2026-23083Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protoc

• CVE-2026-23080Feb 4, 2026
  affected < 6.12.0-160000.27.1fixed 6.12.0-160000.27.1

  In the Linux kernel, the following vulnerability has been resolved: can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak"). In mcba_usb_probe() ->