rpm package
opensuse/kernel-source&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
Vulnerabilities (1,862)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-46315 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 9, 2026 | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the re | ||
| CVE-2026-46314 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can | ||
| CVE-2026-46313 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set | ||
| CVE-2026-46312 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not see a reason why vb2_dma_sg should behave differently. This avoids hitting `WARN_ON(!( | ||
| CVE-2026-46311 | Hig | 7.8 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while | |
| CVE-2026-46310 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1_drm_cleanup() where it should | ||
| CVE-2026-46309 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using co | ||
| CVE-2026-46308 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The f | ||
| CVE-2026-46307 | Hig | 8.3 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net | |
| CVE-2026-46306 | Hig | 7.5 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE session | |
| CVE-2026-46305 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return value of kzalloc_flex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditio | ||
| CVE-2026-46304 | Hig | 7.5 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), t | |
| CVE-2026-46303 | Hig | 8.2 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block num | |
| CVE-2026-46302 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kerne | ||
| CVE-2026-46301 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind | ||
| CVE-2026-46299 | Hig | 7.0 | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key( | |
| CVE-2026-46298 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix race with interrupt handler While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock. This patch fixes both these | ||
| CVE-2026-46297 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: use request_irq for VF misc interrupt Currently, request_threaded_irq() is used with a primary handler but a NULL threaded handler, while also setting the IRQF_ONESHOT flag. This specific combinatio | ||
| CVE-2026-46296 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove(). Drop the | ||
| CVE-2026-46295 | — | < 7.0.12-1.1 | 7.0.12-1.1 | Jun 8, 2026 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Fall back to apic_find_highest_vector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt fr |
- CVE-2026-46315Jun 9, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the re
- CVE-2026-46314Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can
- CVE-2026-46313Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set
- CVE-2026-46312Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not see a reason why vb2_dma_sg should behave differently. This avoids hitting `WARN_ON(!(
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while
- CVE-2026-46310Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1_drm_cleanup() where it should
- CVE-2026-46309Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using co
- CVE-2026-46308Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The f
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE session
- CVE-2026-46305Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return value of kzalloc_flex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditio
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), t
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block num
- CVE-2026-46302Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kerne
- CVE-2026-46301Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind
- affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key(
- CVE-2026-46298Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix race with interrupt handler While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock. This patch fixes both these
- CVE-2026-46297Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: net: libwx: use request_irq for VF misc interrupt Currently, request_threaded_irq() is used with a primary handler but a NULL threaded handler, while also setting the IRQF_ONESHOT flag. This specific combinatio
- CVE-2026-46296Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from probe() back to s3c64xx_spi_prepare_transfer() failed to remove the corresponding deallocation from remove(). Drop the
- CVE-2026-46295Jun 8, 2026affected < 7.0.12-1.1fixed 7.0.12-1.1
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Fall back to apic_find_highest_vector() when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt fr
Page 23 of 94