opensuse/kernel-source&distro=openSUSE Tumbleweed

Vulnerabilities (2,129)

• CVE-2026-31623MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() A malicious USB device claiming to be a CDC Phonet modem can overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-

• CVE-2026-31622HigApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler The NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3 or 4 bytes to target->nfcid1 on each round, but the number of casca

• CVE-2026-31621MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: bnge: return after auxiliary_device_uninit() in error path When auxiliary_device_add() fails, the error block calls auxiliary_device_uninit() but does not return. The uninit drops the last reference and synchr

• CVE-2026-31620MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 A malicious USB device with the TASCAM US-144MKII device id can have a configuration containing bInterfaceNumber=1 but no interface 0. USB configur

• CVE-2026-31619MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: fireworks: bound device-supplied status before string array lookup The status field in an EFW response is a 32-bit value supplied by the firewire device. efr_status_names[] has 17 entries so a status val

• CVE-2026-31618MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the

• CVE-2026-31617MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() The block_len read from the host-supplied NTB header is checked against ntb_max but has no lower bound. When block_len is smaller than opts->nd

• CVE-2026-31616MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() A broken/bored/mean USB host can overflow the skb_shared_info->frags[] array on a Linux gadget exposing a Phonet function by sending an unboun

• CVE-2026-31615MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: renesas_usb3: validate endpoint index in standard request handlers The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint number from the host-supplied wIndex without any sort of valida

• CVE-2026-31614HigApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix off-by-8 bounds check in check_wsl_eas() The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA name and value, but ea_data sits at offset sizeof(struct smb2_file_full_ea_info) =

• CVE-2026-31613HigApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() returns success without any length validation, leaving the symlink parsers as the

• CVE-2026-31612HigApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2_get_ea() smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of t

• CVE-2026-31611HigApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix

• CVE-2026-31610MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc The kernel ASN.1 BER decoder calls action callbacks incrementally as it walks the input. When ksmbd_decode_negTokenInit() reaches the mechTo

• CVE-2026-31609CriApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() smbd_send_batch_flush() already calls smbd_free_send_io(), so we should not call it again after smbd_post_send() moved it to t

• CVE-2026-31608CriApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() smb_direct_flush_send_list() already calls smb_direct_free_sendmsg(), so we should not call it again after post_sendm

• CVE-2026-31607CriApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU.

• CVE-2026-31606MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_hid: don't call cdev_init while cdev in use When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/

• CVE-2026-31605MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide by zero error"), we also need to prevent that same crash from happening in the u

• CVE-2026-31604MedApr 24, 2026
  affected < 7.0.3-1.1fixed 7.0.3-1.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional refere