opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (2,129)

• CVE-2026-64593Aug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: btrfs: do not trim a device which is not writeable [BUG] There is a bug report that btrfs/242 can randomly fail with the following NULL pointer dereference: run fstests btrfs/242 at 2026-06-01 10:25:08 BTR

• CVE-2026-64592Aug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Unconditionally sfence.vma for spurious fault Svvptc does not guarantee that it's safe to just return here. Since we have already cleared our bit, if, theoretically, the bounded timeframe for the acc

• CVE-2026-64591Aug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported")

• CVE-2026-64590Aug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime

• CVE-2026-64589Aug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix NULL-deref on adapter registration failure If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised. Not

• CVE-2026-64588HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring->ready On weakly-ordered architectures, the store to fiq->ops can be reordered past the store to ring->ready, allowing a CPU that sees ring->ready == true via fuse_uring_ready

• CVE-2026-64586HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain bus_reset work on device removal brcmf_fw_crashed() and the debugfs "reset" entry both schedule drvr->bus_reset, whose callback recovers drvr through container_of() and dereferences it. T

• CVE-2026-64585HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: kill anchored URBs before freeing netdevs esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev pr

• CVE-2026-64584HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through con

• CVE-2026-64583HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only af

• CVE-2026-64582HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_del_init(&ip->p

• CVE-2026-64581HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with rcu_derefere

• CVE-2026-64580HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xd

• CVE-2026-64579Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot all

• CVE-2026-64578HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the c

• CVE-2026-64577HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but

• CVE-2026-64576HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g.

• CVE-2026-64575HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then g

• CVE-2026-64574HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which registers the per-link

• CVE-2026-64573Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int