rpm package
opensuse/kernel-source&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
Vulnerabilities (1,862)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-64468 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-af | |
| CVE-2026-64467 | Hig | 8.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the s | |
| CVE-2026-64466 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. C | ||
| CVE-2026-64465 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resour | ||
| CVE-2026-64464 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages | ||
| CVE-2026-64463 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the pro | |
| CVE-2026-64462 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain se | ||
| CVE-2026-64461 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set | ||
| CVE-2026-64460 | Hig | 7.0 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addre | |
| CVE-2026-64459 | Cri | 9.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruct | |
| CVE-2026-64458 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the u | ||
| CVE-2026-64457 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: | ||
| CVE-2026-64456 | Hig | 7.7 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advance | |
| CVE-2026-64455 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a de | ||
| CVE-2026-64454 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain | ||
| CVE-2026-64453 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for | ||
| CVE-2026-64452 | Hig | 7.1 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops th | |
| CVE-2026-64451 | — | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has | ||
| CVE-2026-64450 | Cri | 9.1 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is s | |
| CVE-2026-64449 | Hig | 7.8 | < 7.1.7-1.1 | 7.1.7-1.1 | Jul 25, 2026 | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == |
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-af
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the s
- CVE-2026-64466Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. C
- CVE-2026-64465Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix sleep in atomic context in xhci_free_streams() When a USB device with active stream endpoints is disconnected, xhci_free_streams() is called from the hub_event workqueue to free the stream resour
- CVE-2026-64464Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: xhci: sideband: fix ring sg table pages leak xhci_ring_to_sgtable() allocates a temporary pages array and uses it to build the returned sg_table with sg_alloc_table_from_pages(). The error paths free the pages
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the pro
- CVE-2026-64462Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain se
- CVE-2026-64461Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix IRQ domain leak when port fails to enable When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port from pcie->ports and frees the port structure. However, the IRQ domains set
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Skip VF Resizable BAR restore on read error sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addre
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcp_ao_destroy_sock Commit 51e547e8c89c ("tcp: Free TCP-AO/TCP-MD5 info/keys without RCU") removed the call_rcu() callback from tcp_ao_destroy_sock(), arguing that "the destruct
- CVE-2026-64458Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes from wrong handling of extreme (zero or too high) monitoring intervals user setup. When the u
- CVE-2026-64457Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says:
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advance
- CVE-2026-64455Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a de
- CVE-2026-64454Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disabled and then calls dwc3_disconnect_gadget(). For async callbacks that helper only uses plain
- CVE-2026-64453Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: fix disconnect UAF in client teardown usbio_disconnect() walks usbio->cli_list in reverse and uninitializes each auxiliary device. auxiliary_device_uninit() drops the device reference, and for
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops th
- CVE-2026-64451Jul 25, 2026affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in func_set_flag() func_set_flag() dereferences tr->current_trace_flags before verifying that the current tracer is actually the function tracer. When the active tracer has
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is s
- affected < 7.1.7-1.1fixed 7.1.7-1.1
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE ==
Page 7 of 94