opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (1,862)

• CVE-2026-64408HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller te

• CVE-2026-64407Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() During the v3 firmware download the controller sends a v3_data_req with a 32 bit offset and a 16 bit len. nxp_recv_fw_req_v3() check

• CVE-2026-64406HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving

• CVE-2026-64405Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection was pending, but hdev->sent_cmd can be NULL while req_status is still HCI_REQ_PE

• CVE-2026-64404Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() iso_conn_big_sync() drops the socket lock to call hci_get_route() and then re-acquires it, but dereferences iso_pi(sk)->conn->hcon afterwards with

• CVE-2026-64403HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, ge

• CVE-2026-64402HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring

• CVE-2026-64401HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer.

• CVE-2026-64400HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the s

• CVE-2026-64399CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE The FSCTL_DUPLICATE_EXTENTS_TO_FILE arm of smb2_ioctl() overwrites the destination file's data via vfs_clone_file_range() with neither the share-

• CVE-2026-64398HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level

• CVE-2026-64397CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file h

• CVE-2026-64396HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the conn

• CVE-2026-64395HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask gr

• CVE-2026-64394HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_

• CVE-2026-64393CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: run set info with opener credentials SMB2 SET_INFO handlers call path-based VFS helpers after checking the access mask granted to the SMB handle. Those helpers perform their owner, inode permission and L

• CVE-2026-64392CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal

• CVE-2026-64391CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for ADS I/O Alternate data streams are stored as xattrs. Unlike regular file I/O, their read and write paths therefore call VFS xattr helpers which recheck inode permissions and LS

• CVE-2026-64390HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and du

• CVE-2026-64389HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then c