opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (2,129)

• CVE-2026-64455Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a de

• CVE-2026-64454Jul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain

• CVE-2026-64453HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for

• CVE-2026-64452HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops th

• CVE-2026-64451MedJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has

• CVE-2026-64450CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is s

• CVE-2026-64449HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE ==

• CVE-2026-64448HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes act

• CVE-2026-64447HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev

• CVE-2026-64446HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.suppli

• CVE-2026-64445HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying tha

• CVE-2026-64444HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocRespon

• CVE-2026-64443HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a

• CVE-2026-64442HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pml

• CVE-2026-64441HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate

• CVE-2026-64440HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pI

• CVE-2026-64439CriJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion ca

• CVE-2026-64438HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_di

• CVE-2026-64437HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work wh

• CVE-2026-64436HigJul 25, 2026
  affected < 7.1.7-1.1fixed 7.1.7-1.1

  In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by allocating x->calg and copying only the algorithm name: x->calg = kmalloc_obj(*x-