rpm package
opensuse/kernel-source&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
Vulnerabilities (2,129)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-80783 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() magicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, by splitting the packet and calling | ||
| CVE-2026-80782 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the | ||
| CVE-2026-80781 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->device, field->usa | ||
| CVE-2026-80780 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid->inputs is empty hid_pidff_init_with_quirks() derives its input_dev from list_entry(hid->inputs.next, struct hid_input, list) without first checking that hid->inputs is non | ||
| CVE-2026-80779 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular | ||
| CVE-2026-80778 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different ad | ||
| CVE-2026-80777 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec() race The check for private futexes whether the waiter's mm, which is stored in the futex_key and copied into the pi_state, is the same as the owner's mm is not sufficient for | ||
| CVE-2026-80775 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") mov | ||
| CVE-2026-80774 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB | ||
| CVE-2026-80773 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: huawei: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a U | ||
| CVE-2026-80772 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-by | ||
| CVE-2026-80771 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configur | ||
| CVE-2026-80770 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid_hw_stop on probe failure nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path jumps to err_cl | ||
| CVE-2026-80769 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a US | ||
| CVE-2026-80768 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260_i2c_read() points dev->read_buf at a caller-supplied buffer (often an on-stack variable), arms a completion and waits up to five seconds for t | ||
| CVE-2026-80767 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enable_sensor enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer | ||
| CVE-2026-80766 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrange_timer on remove uclogic_remove() cancels the pen in-range timer and then stops the device: timer_delete_sync(&drvdata->inrange_timer); hid_hw_stop(hdev); timer_de | ||
| CVE-2026-80765 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on | ||
| CVE-2026-80764 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix LE list UAF on reset hci_cc_reset() clears the LE accept and resolving lists without taking hdev->lock. Other command-complete handlers serialize updates to these lists with that lock, | ||
| CVE-2026-80763 | — | < 7.2.5-1.1 | 7.2.5-1.1 | Sep 4, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le |
- CVE-2026-80783Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() magicmouse_raw_event() handles DOUBLE_REPORT_ID (0xf7) packets, which pack two touch reports into one, by splitting the packet and calling
- CVE-2026-80782Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a stale msc->input if no input is claimed magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the
- CVE-2026-80781Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field->usage in hid_set_field() hid_set_field() hands field->usage + offset to hid_dump_input() before the guard that bounds offset: hid_dump_input(field->report->device, field->usa
- CVE-2026-80780Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when hid->inputs is empty hid_pidff_init_with_quirks() derives its input_dev from list_entry(hid->inputs.next, struct hid_input, list) without first checking that hid->inputs is non
- CVE-2026-80779Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ The dedicated hardware timestamp RX queue is allocated with q->index equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only contains the regular
- CVE-2026-80778Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different ad
- CVE-2026-80777Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec() race The check for private futexes whether the waiter's mm, which is stored in the futex_key and copied into the pi_state, is the same as the owner's mm is not sufficient for
- CVE-2026-80775Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") mov
- CVE-2026-80774Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a USB
- CVE-2026-80773Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: huawei: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a U
- CVE-2026-80772Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() joycon_ctlr_read_handler() casts an incoming HID input report to struct joycon_input_report and parses it, guarding the cast only with a 12-by
- CVE-2026-80771Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input device after capabilities are set input_register_device() exposes the device to userspace immediately. In joycon_input_create() it was called before joycon_config_rumble() configur
- CVE-2026-80770Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO before hid_hw_stop on probe failure nintendo_hid_probe() calls hid_device_io_start() before joycon_init() and joycon_leds_create(). If either fails, the error path jumps to err_cl
- CVE-2026-80769Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_usb() check to_usb_interface() can only be used on a hid_device whose parent is really USB; uhid can create devices that identify as being on BUS_USB, but don't actually have a US
- CVE-2026-80768Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after-return write in I2C read race ft260_i2c_read() points dev->read_buf at a caller-supplied buffer (often an on-stack variable), arms a completion and waits up to five seconds for t
- CVE-2026-80767Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enable_sensor enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer
- CVE-2026-80766Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-free of inrange_timer on remove uclogic_remove() cancels the pen in-range timer and then stops the device: timer_delete_sync(&drvdata->inrange_timer); hid_hw_stop(hdev); timer_de
- CVE-2026-80765Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on
- CVE-2026-80764Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix LE list UAF on reset hci_cc_reset() clears the LE accept and resolving lists without taking hdev->lock. Other command-complete handlers serialize updates to these lists with that lock,
- CVE-2026-80763Sep 4, 2026affected < 7.2.5-1.1fixed 7.2.5-1.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci_cc_le
Page 13 of 107