opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (1,862)

• CVE-2026-64585HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: can: esd_usb: kill anchored URBs before freeing netdevs esd_usb_disconnect() frees each CAN netdev with free_candev() inside its per-netdev loop and only calls unlink_all_urbs(dev) afterwards. The per-netdev pr

• CVE-2026-64584HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: cancel pending IN work before freeing the midi object The f_midi driver embeds a work item (midi->work) whose handler, f_midi_in_work(), dereferences the enclosing struct f_midi through con

• CVE-2026-64583HigAug 6, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devm_request_irq() in bdc_udc_init(), so the IRQ is released by devm only af

• CVE-2026-64582HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_del_init(&ip->p

• CVE-2026-64581HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with rcu_derefere

• CVE-2026-64580HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xd

• CVE-2026-64579Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot all

• CVE-2026-64578HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first checking that the c

• CVE-2026-64577HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr + gtp1_header), but

• CVE-2026-64576HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_init() fails (e.g.

• CVE-2026-64575HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then g

• CVE-2026-64574HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which registers the per-link

• CVE-2026-64573Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int

• CVE-2026-64572Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails,

• CVE-2026-64571Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds th

• CVE-2026-64570HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fails, it returns -E

• CVE-2026-64569Aug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_

• CVE-2026-64568HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then fail

• CVE-2026-64567HigAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. Tha

• CVE-2026-64566CriAug 5, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_fra