opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (1,862)

• CVE-2026-64368HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is

• CVE-2026-64367HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the

• CVE-2026-64366HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert wacom_wac_queue_insert() calls kfifo_skip() in a loop when the kfifo doesn't have enough space for the incoming report. If the kfifo is empty,

• CVE-2026-64365Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrange_timer at driver unbind letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_in

• CVE-2026-64364HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexe

• CVE-2026-64363Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: appleir: fix UAF on pending key_up_timer in remove() appleir_remove() runs hid_hw_stop() before timer_delete_sync(). hid_hw_stop() synchronously unregisters the HID input device via hid_disconnect() -> hid

• CVE-2026-64362Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: HID: lg-g15: cancel pending work on remove to fix a use-after-free lg_g15_data is allocated with devm and holds a work item. The report handlers schedule that work straight from device input. lg_g15_event() and

• CVE-2026-64361HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e

• CVE-2026-64360Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corr

• CVE-2026-64359Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Syzbot reported a hung task in nilfs_transaction_begin() where multiple tasks performing chmod() on a nilfs2 mount blocked for over 143 seco

• CVE-2026-64358Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtk_jpeg_release function cancels any pending or running work present in the driver workqueue using cancel_work_s

• CVE-2026-64357Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfs_exchmaps_estimate_overhead() adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINT_MAX check still tests req->resblks. That is the rese

• CVE-2026-64356Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfs_dqinode_metadir_create() If xfs_metadir_create() fails in xfs_dqinode_metadir_create(), the current code returns directly, leaking the allocated update and transaction state. If the

• CVE-2026-64355CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented fra

• CVE-2026-64354HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands repeatable fields from array elements into the fixe

• CVE-2026-64353Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replac

• CVE-2026-64352Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trie_lookup_elem() annotates its rcu_dereference_check() walks with only rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c) resolves to "c || rcu

• CVE-2026-64351Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that skb->len is at l

• CVE-2026-64350Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array with cdnsp_alloc_stream_ctx(). If a later stream ring allocation or strea

• CVE-2026-64349Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() The dwc3_ulpi_setup() calls the register read and write calls with dwc3->regs when both these calls take the dwc3 structure directly. Ch