opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (2,129)

• CVE-2026-46322HigJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_b

• CVE-2026-46321HigJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discar

• CVE-2026-46320HigJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without fr

• CVE-2026-46319HigJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section bef

• CVE-2026-46318Jun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") with conflict resolution to account for changes in commit ea52

• CVE-2026-46317HigJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run

• CVE-2026-46316CriJun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each en

• CVE-2026-46315Jun 9, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: clear waitid info before copying it to userspace IORING_OP_WAITID stores its result fields in struct io_waitid::info and later copies them to userspace siginfo. The prep path initializes the re

• CVE-2026-46314Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() walks a userspace-provided singly-linked list of ioctl extensions without any bound on the chain length. A local user can

• CVE-2026-46313Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed to be an error pointer not NULL so this condition is true and the error pointer is dereferenced. So isp-psys should be set

• CVE-2026-46312Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not see a reason why vb2_dma_sg should behave differently. This avoids hitting `WARN_ON(!(

• CVE-2026-46311HigJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while

• CVE-2026-46310Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module on gen 4, we hit a NULL pointer dereference. This is caused by the cleanup code calling vsp1_drm_cleanup() where it should

• CVE-2026-46309Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using co

• CVE-2026-46308Jun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The f

• CVE-2026-46307HigJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net

• CVE-2026-46306HigJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE session

• CVE-2026-46305MedJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return value of kzalloc_flex() is used without ensuring that the allocation succeeded, and the pointer is dereferenced unconditio

• CVE-2026-46304HigJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), t

• CVE-2026-46303HigJun 8, 2026
  affected < 7.0.12-1.1fixed 7.0.12-1.1

  In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block num