SB2026110121 - SUSE update for the Linux Kernel
Published: November 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 57 vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2026-97416)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in btrfs_may_alloc_data_chunk() when processing corrupted Btrfs metadata during a balance operation. A local user can trigger a Btrfs balance operation on a filesystem whose chunk tree contains a chunk without a corresponding block group to cause a denial of service.
The issue occurs when CONFIG_BTRFS_ASSERT is disabled.
2) Race condition (CVE-ID: CVE-2026-74675)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in kbd_keycode in drivers/tty/vt/keyboard.c when handling keyboard input while accessing vc->port.tty. A local user can trigger the race to cause a denial of service.
3) Use-after-free (CVE-ID: CVE-2026-80977)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.
The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.
4) Out-of-bounds read (CVE-ID: CVE-2026-89542)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper length validation in gss_krb5_unwrap_v2() and its rotation helpers when processing a short or malformed GSS token. A remote user can provide a token shorter than the required header or with a declared length exceeding the buffer bounds to cause a denial of service.
The flawed length arithmetic can result in an out-of-bounds read, an unsigned underflow during cleanup, or a divide-by-zero during buffer rotation.
5) Out-of-bounds read (CVE-ID: CVE-2026-89726)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read memory beyond the specified length.
The vulnerability exists due to an off-by-one out-of-bounds read in ucs2_strnlen() in lib/ucs2_string.c when processing a UCS-2 string that is not NUL-terminated within the caller-provided maximum length. A local user can supply a non-NUL-terminated UCS-2 string to read memory beyond the specified length.
6) Out-of-bounds read (CVE-ID: CVE-2026-89778)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read memory out of bounds.
The vulnerability exists due to an out-of-bounds read in zisofs_fill_pages() when reading a compressed file on a mounted ISO9660 image containing a crafted ZF Rock Ridge record. A remote attacker can provide a crafted ISO9660 image to read memory out of bounds.
The issue is triggered when an empty zisofs block follows a sub-page block with a nonzero page offset.
7) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89987)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause silent data loss.
The vulnerability exists due to failure to propagate the PMD dirty bit in zap_huge_pmd_folio() when unmapping a PMD-mapped MAP_SHARED tmpfs mapping after data has been written through a read-faulted mapping. A local user can write data through a shared tmpfs mapping and unmap it to cause silent data loss.
Exploitation requires shmem transparent huge pages and swap to be enabled.
8) Out-of-bounds read (CVE-ID: CVE-2026-90011)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the iSCSI target login payload buffer when processing a crafted login PDU without a terminating null byte. A remote attacker can send a crafted login PDU to disclose sensitive information and cause a denial of service.
Exploitation is reachable through the CHAP authentication path on a portal configured for CHAP.
9) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90283)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause huge page reservations to remain charged.
The vulnerability exists due to improper resource cleanup in the hugetlbfs_fill_super() failure path when initiating a hugetlbfs mount with size or min_size options and root dentry creation fails. A local user can trigger the mount failure path to cause huge page reservations to remain charged.
10) Deadlock (CVE-ID: CVE-2026-93252)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.
Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.
11) Memory corruption (CVE-ID: CVE-2026-93287)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper bounds checking in the i2c-stub driver's stub_xfer function when processing caller-supplied I2C_SMBUS_I2C_BLOCK_DATA transfers. A local user can issue a crafted SMBus block transfer with an oversized length to cause a denial of service.
12) Out-of-bounds read (CVE-ID: CVE-2026-93287)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read memory out of bounds.
The vulnerability exists due to an out-of-bounds read in the smbus_write tracepoint when processing caller-supplied oversized SMBus block writes. A local user can issue an SMBus block write with an oversized length to read memory out of bounds.
13) Use-after-free (CVE-ID: CVE-2026-93800)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the btrfs relocation root cleanup logic when handling errors returned by btrfs_update_reloc_root() during relocation. A local user can trigger relocation that encounters an error and unmount the filesystem to cause a denial of service.
14) Use-after-free (CVE-ID: CVE-2026-93820)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free race condition in Rockchip PCIe host controller root bus removal when rescan or hotplug operations are triggered concurrently via sysfs. A local user can race root bus removal with concurrent rescan or hotplug operations to cause a denial of service.
15) Use-after-free (CVE-ID: CVE-2026-93822)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a system crash.
The vulnerability exists due to a race condition in PCI iProc root bus removal when concurrently triggering sysfs rescan or hotplug operations. A local user can trigger concurrent sysfs rescan or hotplug operations to cause a system crash.
16) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74653)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a stuck RX timeout condition in 8250_of for the LPC32xx UART when handling serial port interrupts. A local user can repeatedly open the front-panel serial port to cause a denial of service.
The issue can trigger a persistent interrupt storm that livelocks the CPU and trips the soft-lockup detector on affected single-core systems.
17) Resource exhaustion (CVE-ID: CVE-2026-97491)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in rds_ib_conn_path_shutdown when tearing down InfiniBand network configurations. A local user can initiate teardown of InfiniBand network configurations to cause a denial of service.
18) Resource exhaustion (CVE-ID: CVE-2026-98010)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.
Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.
19) Out-of-bounds read (CVE-ID: CVE-2026-98077)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in sip_skip_whitespace() in nf_conntrack_sip when processing a SIP payload containing a recognized header name followed by whitespace at the end of the payload. A remote attacker can send such a crafted SIP payload to trigger an out-of-bounds read.
20) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98130)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to a time-of-check to time-of-use race condition in the SCTP_CMD_TIMER_START handler when processing SCTP timer start commands. A remote attacker can trigger the race condition to trigger a use-after-free.
21) Race condition (CVE-ID: CVE-2026-98252)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.
The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.
22) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98269)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause persistent filesystem inconsistencies.
The vulnerability exists due to improper handling of inode update failures in btrfs_replace_file_extents() when performing hole punching or reflinking. A local user can perform hole punching or reflinking operations that encounter an inode update failure to cause persistent filesystem inconsistencies.
Exploitation requires the transaction to be committed after the inode update failure.
23) Race condition (CVE-ID: CVE-2026-98347)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.
24) Memory leak (CVE-ID: CVE-2026-98354)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.
The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.
Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.
25) Use-after-free (CVE-ID: CVE-2026-98357)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.
The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.
26) NULL pointer dereference (CVE-ID: CVE-2026-98358)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.
The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.
27) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98359)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an RDMA port query to operate on an unregistered and uninitialized network device.
The vulnerability exists due to a missing registration-state check in ib_get_eth_speed() when processing asynchronous RDMA port queries during network device unregistration. A local user can trigger an asynchronous RDMA port query to cause an RDMA port query to operate on an unregistered and uninitialized network device.
The reference returned by ib_device_get_netdev() keeps the network device structure allocated but does not ensure that the device remains operational. The ethtool callback can be invoked after NETDEV_UNREGISTER and ndo_uninit have completed.
28) Integer overflow (CVE-ID: CVE-2026-98365)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the Linux kernel RDMA/rxe mr_check_range() function when validating memory ranges supplied in RDMA read or write requests. A remote attacker can send a specially crafted RDMA request whose address and length cause arithmetic wraparound, bypassing the range check and triggering an out-of-bounds read or write and a kernel oops to cause a denial of service.
29) Improper input validation (CVE-ID: CVE-2026-99999)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt IPv4 packet headers and potentially compromise system confidentiality, integrity, and availability.
The vulnerability exists due to improper validation of the checksum start offset in the Linux kernel IPv4 checksum-completion paths when processing packets with invalid checksum metadata. A remote attacker can introduce a packet whose checksum start offset precedes the end of its IPv4 header into an affected processing path to cause skb_checksum_help to corrupt the network header, potentially compromising system confidentiality, integrity, and availability.
30) Double free (CVE-ID: CVE-2026-68236)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in dm_update_crtc_state() in the AMD display manager when handling error paths after releasing new_stream on the skip_modeset path. A local user can trigger a later error condition after the initial release to cause a denial of service.
The issue occurs because a dangling pointer may be released again after a color management failure reaches the fail label.
31) Memory leak (CVE-ID: CVE-2023-54158)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the block_rsv_release_bytes() function in fs/btrfs/block-rsv.c. A local user can perform a denial of service (DoS) attack.
32) Improper locking (CVE-ID: CVE-2023-54180)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the repair_io_failure() function in fs/btrfs/extent_io.c. A local user can perform a denial of service (DoS) attack.
33) Improper locking (CVE-ID: CVE-2025-68358)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the fs/btrfs/space-info.h. A local user can perform a denial of service (DoS) attack.
34) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43299)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a read-only filesystem state in btrfs_repair_io_failure() when processing read-repair operations after the filesystem flips to read-only following a critical error. A local user can trigger the error condition to cause a denial of service.
The issue is triggered when a read repair is pending while the filesystem becomes read-only due to a critical error such as ENOSPC in a critical path.
35) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-63948)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a reference leak in l2cap_chan_timeout() in the Bluetooth L2CAP subsystem when handling a channel timeout with a null connection pointer. A local user can trigger this condition to cause a denial of service.
36) Uncontrolled Recursion (CVE-ID: CVE-2026-63983)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in netem packet duplication handling in the netem qdisc when processing duplicated packets through a qdisc tree containing another netem instance. A local user can trigger packet duplication to cause a denial of service.
Exploitation can exhaust stack or memory when packet duplication is enabled and duplicated packets are re-enqueued through another netem in the tree.
37) NULL pointer dereference (CVE-ID: CVE-2026-64012)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.
Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().
38) Improper input validation (CVE-ID: CVE-2026-64280)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in afu_ioctl_dma_map() when handling a DFL_FPGA_PORT_DMA_MAP ioctl request with a user-supplied length. A local user can provide an excessively large length value to cause a denial of service.
39) Out-of-bounds read (CVE-ID: CVE-2026-64422)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.
Exploitation requires tcp_mtu_probing to be set to 2.
40) Out-of-bounds read (CVE-ID: CVE-2026-64456)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.
The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.
41) NULL pointer dereference (CVE-ID: CVE-2026-64593)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in btrfs_trim_free_extents in the Btrfs filesystem when processing a FITRIM ioctl on a rescanned device that is not writeable. A local user can issue a trim request to trigger a kernel crash and cause a denial of service.
The issue occurs when a previously missing device is rescanned, clearing the missing-device state while the block device pointer remains NULL.
42) Division by zero (CVE-ID: CVE-2026-68106)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to division by zero in the amdgpu UVD H264 and H264 Perf decode paths when processing crafted frame dimensions with a width or height less than 16. A local user can submit crafted decoding parameters to cause a denial of service.
43) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68233)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper shutdown of a timer in vc4_bo_cache_destroy() in the vc4 BO cache when tearing down the BO cache. A local user can trigger the affected code path to cause a denial of service.
44) Memory leak (CVE-ID: CVE-2022-50578)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the __class_register() function in drivers/base/class.c. A local user can perform a denial of service (DoS) attack.
45) NULL pointer dereference (CVE-ID: CVE-2026-68303)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the vc4_hvs_unbind and vc4_v3d_unbind functions when unbinding dependent vc4 drivers after vc4-drm removal. A local user can trigger driver unbind operations to cause a denial of service.
The issue occurs because the dependent drivers access master driver data after the vc4-drm device has already been removed.
46) Race condition (CVE-ID: CVE-2026-68323)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in tipc_udp_rcast_add() and cleanup_bearer() in net/tipc/udp_media.c when updating the udp bearer replicast list during peer discovery and bearer cleanup. A local user can enable a TIPC bearer from an unprivileged user namespace and trigger concurrent list updates to cause a denial of service.
The issue can corrupt the kernel list structure and trigger a kernel BUG during bearer cleanup.
47) Reachable assertion (CVE-ID: CVE-2026-68430)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a reachable assertion in the amdgpu gfx8 fence emission logic when processing GPU fence operations. A local user can trigger the affected code path to cause a denial of service.
The issue results in a kernel crash.
48) Double free (CVE-ID: CVE-2026-72015)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.
The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.
49) Observable discrepancy (CVE-ID: CVE-2026-72236)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper restriction of speculative execution in __hw_perf_event_init() in arch/s390/kernel/perf_cpum_cf.c when processing a user-controlled perf event configuration value as an array index. A local user can supply a crafted event->attr.config value to disclose sensitive information.
50) Improper input validation (CVE-ID: CVE-2026-72319)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ip_vs_in_icmp in the IPVS subsystem when processing ICMP error packets from tunnels. A remote attacker can send a specially crafted ICMP error packet to cause a denial of service.
The issue involves inner IP headers not being ensured in skb headroom after outer headers are stripped, and additional length checks were required for the inner headers.
51) Use-after-free (CVE-ID: CVE-2026-72476)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in dma_release_channel() when releasing a dma channel. A local user can trigger the release of a channel whose device reference may already be freed to cause a denial of service.
52) Use-after-free (CVE-ID: CVE-2026-72493)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition leading to use-after-free in enqueue_to_backlog() when processing packets during device unregistration. A local attacker can trigger packet transmission during device unregistration to cause a denial of service.
The issue occurs because a packet can escape backlog flushing during network namespace exit or similar device unregistration timing.
53) Out-of-bounds read (CVE-ID: CVE-2026-74408)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in ath_tx_edma_tasklet() when processing a firmware-provided tx status queue ID. A local attacker can provide an invalid queue ID value to trigger an out-of-bounds array access and cause a denial of service.
54) Improper input validation (CVE-ID: CVE-2026-74544)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the cls_u32 packet classifier when processing a crafted filter configuration with varoffset enabled. A local user can supply an out-of-range offshift value to trigger shift-out-of-bounds behavior and cause a denial of service.
Exploitation is possible by an unprivileged user via user or network namespaces.
55) Race condition (CVE-ID: CVE-2026-74578)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose plaintext and compromise cryptographic operation integrity.
The vulnerability exists due to improper synchronization of shared cryptographic state in the AIO/async path in skcipher_recvmsg() when handling async skcipher receive operations. A local user can race an asynchronous skcipher receive operation with sendmsg(ALG_SET_IV) to disclose plaintext and compromise cryptographic operation integrity.
The described plaintext recovery applies to CTR/stream modes through IV/keystream reuse.
56) Use-after-free (CVE-ID: CVE-2026-74583)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.
The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.
57) Use-after-free (CVE-ID: CVE-2026-74587)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP ASCONF handling code when processing a delayed authenticated ASCONF-ACK after peer restart handling purges the ASCONF queue. A remote attacker can send a delayed authenticated ASCONF-ACK to cause a denial of service.
The issue occurs because a cached ASCONF chunk pointer can remain dangling while the association is still alive during peer restart handling.
Remediation
Install update from vendor's website.