A security update for the SUSE Linux Enterprise 15 SP7 RT kernel addresses multiple security vulnerabilities across various kernel components, including hardware monitoring, Bluetooth, SCSI, networking, tracing, and more. These fixes resolve issues such as null pointer dereferences, memory leaks, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update mitigates a broad range of potential security risks by correcting these defects.
A use-after-free vulnerability in the Linux kernel's scheduling cache grouping was resolved by decoupling sched_cache_group from the memory management (mm) structure. The issue arose because scheduling statistics were tied to the mm lifecycle, allowing potential access to freed memory when a task switched mm concurrently with scheduling accounting. The fix introduces a refcounted sched_cache_group object managed independently from mm_struct, preventing stale access and enabling more flexible task grouping in the future.
A heap-based buffer overflow vulnerability exists in the Samsung Opensource rlottie library, triggered via environment variables. This vulnerability affects multiple specific versions of rlottie and has a medium severity rating with a CVSS score of 5.5. The flaw can cause a denial of service by impacting availability but does not affect confidentiality or integrity. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A vulnerability in libhangul occurs when parsing Hanja dictionary files without verifying that entries contain valid values alongside their keys. This flaw can be exploited by providing a specially crafted dictionary file to trigger an application crash, resulting in a denial of service (DoS). The issue affects multiple specific versions of libhangul. The CVSS score is 5.5, indicating a medium severity impact primarily due to availability disruption. No patch or remediation information is provided in the available data.
A vulnerability in the Linux kernel's BPF subsystem involving percpu array inner map replacement has been resolved. The issue arises because the original map_meta_equal function does not compare max_entries, allowing an inner map with fewer max_entries to bypass checks. This can lead to out-of-bounds access during lookups. The fix involves pointing percpu_array_map_ops.map_meta_equal to a function that enforces max_entries equality and adding a selftest to prevent replacement with differently-sized inner maps.
A vulnerability in the Linux kernel's VLAN tag insertion code could cause uninitialized memory to be transmitted when certain conditions are met, specifically when the MAC header is not present in __vlan_insert_inner_tag(). This occurs because the function assumes the MAC header is present and rewrites bytes without verifying this, leading to potential leakage of kernel memory contents. The issue has been resolved by requiring the MAC header to be present before rewriting. The vulnerability affects specific Linux kernel versions listed and is rated medium severity.
A use-after-free vulnerability in the Linux kernel's BPF subsystem was resolved. The issue occurs because the bpf_link_prime() function inserts a link before it is fully settled, leading to a dangling reference if anon_inode_getfile() fails. This causes the iterator to access freed memory, potentially triggering a kernel panic.
A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module allows an unprivileged user to trigger a NULL pointer dereference via IPv6 reverse-path filtering. This occurs because ip6_route_lookup() can return a route with a NULL inet6_dev pointer, leading to a kernel crash (general protection fault). The issue arises when lowering an external nexthop device's MTU below IPV6_MIN_MTU, which tears down its inet6_dev while routes remain in the forwarding information base (FIB).
A vulnerability in the Linux kernel's network scheduler (net/sched) was resolved that involved improper handling of IDR error pointers during action deletion in the tcf_action_delete() function. This flaw could lead to a kernel panic due to a null pointer dereference when tcf_idr_delete_index() misinterprets an error pointer as a valid action. The issue was identified through kernel address sanitizer (KASAN) reports and reproduced using hardware execution breakpoints. The fix involves rejecting error pointers and returning an error code instead of dereferencing invalid memory.
A vulnerability in the Linux kernel's veth driver involves improper management of XDP program pointers during channel resizing in the veth_set_channels() function. This flaw can lead to use-after-free conditions where freed XDP programs may be executed again, causing kernel panics and fatal exceptions in interrupt context.
A vulnerability in the Linux kernel's BPF subsystem allows programs bound to specific network devices to be incorrectly matched to other devices. This can cause kernel crashes due to invalid memory accesses when running certain BPF programs on mismatched network devices. The issue arises from improper handling of device-bound BPF programs, leading to potential kernel panics and general protection faults.
A vulnerability in the Linux kernel related to the BPF subsystem has been resolved. Specifically, LWT_SEG6LOCAL programs could combine bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data() helpers in a way that leads to a dangling pointer and unsafe memory writes. The kernel now disallows the use of bpf_skb_pull_data() in LWT_SEG6LOCAL programs to prevent this unsafe condition. Other LWT program types remain unaffected in this regard.
A vulnerability in the Linux kernel's BPF subsystem was fixed to address an out-of-bounds read of the sk_protocol field in the bpf_sock_destroy() function. The issue arises because sk_protocol resides in struct sock, not struct sock_common, and certain socket states passed to bpf_sock_destroy() cause the code to read beyond the intended memory region. This flaw was corrected by ensuring sk_protocol is only checked on full socket structures, aligning with how tcp_abort() handles specific socket states.
CVE-2026-105516 is a medium severity vulnerability affecting multiple specific versions of the nfs-ganesha product. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available. No known exploits are reported in the wild. The affected versions include a range of releases from 2.4.5-2 through 9.14-1, including various Ubuntu package versions. No patch or remediation information is provided, and the product is not a cloud service.
CVE-2026-105517 is a medium severity vulnerability affecting multiple specific versions of the nfs-ganesha software. No detailed description or technical details about the nature of the vulnerability are available. There is no CVSS score or known exploit information provided. The affected versions include a range of releases from 2.4.5-2 up to 9.14-1, including various Ubuntu package versions.
A heap-based buffer overflow vulnerability exists in the PNG metadata reader of Eye of GNOME (eog) due to improper state handling when parsing split metadata chunks. This flaw can be triggered by opening a specially crafted PNG file, potentially causing a denial of service via application crash or enabling arbitrary code execution. The vulnerability affects multiple specific versions of eog. The CVSS score is 5.5, indicating a medium severity level.
A vulnerability in ansible-core allows an attacker to craft a malicious collection tarball that exploits improper symbolic link handling during collection installation. This flaw enables overwriting arbitrary files on the control node with the privileges of the user running ansible-galaxy, potentially leading to code execution. The issue is a bypass of a previous fix (CVE-2020-10691).
Dolibarr ERP CRM versions before 24.0.2 have an authorization vulnerability in the updateextrafield.php script. The vulnerability arises because the script checks only read permissions before allowing modifications to extrafield values. This flaw allows authenticated users with read-only access to modify extrafields on various objects such as third parties, products, members, projects, or contacts.
An integer underflow vulnerability in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This occurs when an authenticated user modifies a key document in the key vault collection or when a KMS endpoint containing a colon after its path or query is accepted during key creation. The vulnerability does not result in memory access outside allocated bounds. The CVSS score is 6.5, indicating a medium severity impact primarily affecting availability.
A vulnerability in luksmeta allows a local attacker with administrative privileges to cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Incorrect boundary calculations and flawed overlap detection can lead to writing metadata beyond free space or over existing records, potentially corrupting encrypted payload data or metadata and making data inaccessible.