rpm package
opensuse/kernel-source&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
Vulnerabilities (2,129)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64475 | Hig | 8.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device( | |
| CVE-2026-64474 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support unti | ||
| CVE-2026-64473 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_ | ||
| CVE-2026-64472 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently up | ||
| CVE-2026-64471 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually di | ||
| CVE-2026-64470 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion ca | ||
| CVE-2026-64469 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a proces | |
| CVE-2026-64468 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-af | |
| CVE-2026-64467 | Hig | 8.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the s | |
| CVE-2026-64466 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. C | ||
| CVE-2026-64465 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resour | ||
| CVE-2026-64464 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages | ||
| CVE-2026-64463 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the pro | |
| CVE-2026-64462 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain se | ||
| CVE-2026-64461 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set | ||
| CVE-2026-64460 | Hig | 7.0 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addre | |
| CVE-2026-64459 | Cri | 9.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruct | |
| CVE-2026-64458 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the u | ||
| CVE-2026-64457 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: | ||
| CVE-2026-64456 | Hig | 7.7 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advance |
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device(
- CVE-2026-64474Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc vfio_mig_get_next_state() walks vfio_from_fsm_table[] one step at a time, looping to skip optional states the device does not support unti
- CVE-2026-64473Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_
- CVE-2026-64472Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix racy bitfields and tighten struct layout Bitfield operations are not atomic, they use a read-modify-write pattern, therefore we should be careful not to pack bitfields that can be concurrently up
- CVE-2026-64471Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on registration failure Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually di
- CVE-2026-64470Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: fix use-after-free on marvell probe failure Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion ca
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_thread_release() When a thread exits, binder_thread_release() walks its transaction stack to clear the t->from and t->to_proc that correspond with the exiting thread. However, a proces
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-af
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the s
- CVE-2026-64466Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. C
- CVE-2026-64465Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resour
- CVE-2026-64464Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the pro
- CVE-2026-64462Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain se
- CVE-2026-64461Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addre
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruct
- CVE-2026-64458Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the u
- CVE-2026-64457Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says:
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advance
Page 20 of 107