CVE-2026-43450

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree.

This happens as follows:

1. Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2. Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A);

3. Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4. Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.

Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.(CVE-2025-39759)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'.(CVE-2025-39952)

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.(CVE-2025-68330)

In the Linux kernel, the following vulnerability has been resolved:

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it.(CVE-2025-68755)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)

• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

Bug Fix(es) and Enhancement(s):

• kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-9.8.z] (JIRA:Rocky Linux-186331)

• [Rocky Linux 9.4] Kernel memory reclaim bug [rhel-9.8.z] (JIRA:Rocky Linux-211058)

• Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [rhel-9.8.z] (JIRA:Rocky Linux-215575)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)

• kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)

• kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)

• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

• kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)

• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

• kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)

• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

• kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)

• kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)

• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

• kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)

• kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)

• kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)

• kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)

• kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

• kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)

• kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)

• kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)

• kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)

• kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)

• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

• kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)

• kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)

• kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)

• kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)

Bug Fix(es) and Enhancement(s):

• Rocky Linux 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.2.z] (JIRA:Rocky Linux-188180)

• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-10.2.z] (JIRA:Rocky Linux-193043)

• ss core dumped when there is an SCTP session [rhel-10.2.z] (JIRA:Rocky Linux-212393)

• [Rocky Linux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:Rocky Linux-218627)

• Rocky Linux10.0 - s390/pfault: Fix virtual vs physical address confusion [rhel-10.2.z] (JIRA:Rocky Linux-222507)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-43450 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-43450 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-43450 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)

• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

Bug Fix(es) and Enhancement(s):

• kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-9.8.z] (JIRA:Rocky Linux SIG Cloud-186331)

• [Rocky Linux SIG Cloud 9.4] Kernel memory reclaim bug [rhel-9.8.z] (JIRA:Rocky Linux SIG Cloud-211058)

• Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [rhel-9.8.z] (JIRA:Rocky Linux SIG Cloud-215575)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
• kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
• kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
• kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
• kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)

Bug Fix(es) and Enhancement(s):

• kernel panic at trailing_symlink while the task wdavdaemon runs even after 4c4f7c19b3c7 (JIRA:AlmaLinux-152759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
• kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
• kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
• kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
• kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)

Bug Fix(es) and Enhancement(s):

• kernel panic at trailing_symlink while the task wdavdaemon runs even after 4c4f7c19b3c7 (JIRA:AlmaLinux-152759)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)
• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)

Bug Fix(es) and Enhancement(s):

• kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-9.8.z] (JIRA:AlmaLinux-186331)
• [AlmaLinux 9.4] Kernel memory reclaim bug [almalinux-9.8.z] (JIRA:AlmaLinux-211058)
• Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [almalinux-9.8.z] (JIRA:AlmaLinux-215575)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: seccomp: passthrough uretprobe systemcall without filtering (CVE-2025-21834)
• kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003)
• kernel: netfilter: nf_tables: Fix for duplicate device in netdev hooks (CVE-2026-43454)
• kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
• kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CVE-2026-53026)
• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
• kernel: mm/list_lru: drain before clearing xarray entry on reparent (CVE-2026-53153)
• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
• kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136)
• kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
• kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
• kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438)
• kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)
• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
• kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
• kernel: mm: shrinker: fix shrinker_info teardown race with expansion (CVE-2026-64418)
• kernel: smb: client: fix change notify replay double-free (CVE-2026-64384)
• kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
• kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
• kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
• kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166)
• kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069)
• kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
• kernel: ceph: give up on paths longer than PATH_MAX (CVE-2024-53685)
• kernel: ceph: fix memory leaks in ceph_mdsc_build_path() (CVE-2026-43419)
• kernel: ceph: add a bunch of missing ceph_path_info initializers (CVE-2026-43408)

Bug Fix(es) and Enhancement(s):

• AlmaLinux 10: s390: Revert support for DCACHE_WORD_ACCESS [almalinux-10.2.z] (JIRA:AlmaLinux-188180)
• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-10.2.z] (JIRA:AlmaLinux-193043)
• ss core dumped when there is an SCTP session [almalinux-10.2.z] (JIRA:AlmaLinux-212393)
• [AlmaLinux-10.2.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-218627)
• AlmaLinux10.0 - s390/pfault: Fix virtual vs physical address confusion [almalinux-10.2.z] (JIRA:AlmaLinux-222507)

For more details about the security…

• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• drm: Fix use-after-free read in drm_getunique() {CVE-2021-47280}
• net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309}
• regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483}
• netfilter: nftables: avoid overflows in nft_hash_buckets() {CVE-2021-46992}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• netfilter: synproxy: Fix out of bounds when parsing TCP options {CVE-2021-47245}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• smb: client: reject userspace cifs.spnego descriptions
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• usb: cdc-wdm: avoid setting WDM_READ for ZLP-s {CVE-2026-43427}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}

• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• module: limit enabling module.sig_enforce {CVE-2021-35039}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• HID: elan: Fix potential double free in elan_input_configured {CVE-2022-49508}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• virtio_console: Assure used length from device is limited {CVE-2021-38160}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• drm/i915/perf: add sentinel to xehp_oa_b_counters {CVE-2023-53646}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• thermal: core: prevent potential string overflow {CVE-2023-52868}
• drm/radeon: possible buffer overflow {CVE-2023-52867}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}

• smb: client: reject userspace cifs.spnego descriptions
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• usb: cdc-wdm: avoid setting WDM_READ for ZLP-s {CVE-2026-43427}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}

• smb: client: reject userspace cifs.spnego descriptions
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• usb: cdc-wdm: avoid setting WDM_READ for ZLP-s {CVE-2026-43427}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}

• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}

• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ALSA: usb-audio: Use the right limit for PCM OOB check
• ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
• rcu: Fix rcu_read_unlock() deadloop due to softirq
• rcu: Fix racy re-initialization of irq_work causing hangs
• RDMA/efa: Fix possible deadlock {CVE-2026-31493}
• RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
• RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
• RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
• RDMA/efa: Extend admin timeout error print
• RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
• kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
• exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
• af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
• kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
• smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
• sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
• RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
• drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
• net: hinic: fix memory leak when reading function table {CVE-2022-50438}
• device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
• libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
• net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
• nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
• leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
• bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
• RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
• tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
• kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
• NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
• i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
• can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
• regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
• wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
• netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
• can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
• bpf: Fix…

• fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
• macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
• bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475}
• unshare: fix unshare_fs() handling {CVE-2026-43472}
• netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
• nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
• e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
• cgroup: fix race between task migration and iteration {CVE-2026-43439}
• ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
• usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
• tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
• nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
• ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
• netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
• net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
• net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
• net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
• netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
• netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
• sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
• PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
• net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
• netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
• nvmet: fix memory leak of bio integrity {CVE-2025-38405}
• nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400}
• dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015}
• bonding: check xdp prog when set bond mode {CVE-2025-22105}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
• netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
• ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
• perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
• x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
• dm: remove fake timeout to avoid leak request {CVE-2026-43314}
• drm: Account property blob allocations to memcg {CVE-2026-43287}
• HID:…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2026-31778
  • ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• CVE-2026-43011
  • net/x25: Fix potential double free of skb {CVE-2026-43011}
• CVE-2026-31602
  • ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• CVE-2026-31622
  • NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
• CVE-2026-31583
  • media: em28xx: fix use-after-free in em28xx_v4l2_open() {CVE-2026-31583}
• CVE-2026-31659
  • batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• CVE-2023-53596
  • drivers: base: Free devm resources when unregistering a {CVE-2023-53596}
• CVE-2026-31696
  • rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
• CVE-2022-50497
  • binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• CVE-2026-23372
  • nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
• CVE-2026-23193
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
• CVE-2023-53619
  • netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• CVE-2023-53285
  • ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-31405
  • media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• CVE-2026-31629
  • nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629}
• CVE-2025-71136
  • media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() {CVE-2025-71136}
• CVE-2026-31417
  • net/x25: Fix overflow when accumulating packets {CVE-2026-31417}
• CVE-2026-43020
  • Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• CVE-2026-43040
  • net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• CVE-2026-31748
  • comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748}
• CVE-2026-31747
  • comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747}
• CVE-2026-31576
  • media: hackrf: fix to not free memory after the device is registered in hackrf_probe() {CVE-2026-31576}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-23388
  • Squashfs: check metadata block offset is within range {CVE-2026-23388}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31720
  • usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• Bump ABI 4.4.0-283

• CVE-2026-31602
  • ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• CVE-2026-43241
  • ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access {CVE-2026-43241}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2025-71116
  • libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• CVE-2022-49892
  • ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• CVE-2022-3625
  • devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2026-31581
  • ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• CVE-2025-68366
  • nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-23361
  • PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry {CVE-2026-23361}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-71199
  • iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver {CVE-2025-71199}
• CVE-2026-31626
  • staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2025-71136
  • media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() {CVE-2025-71136}
• CVE-2026-31780
  • wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation {CVE-2026-31780}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-43370
  • drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• CVE-2026-43011
  • net/x25: Fix potential double free of skb {CVE-2026-43011}
• CVE-2026-43027
  • netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• CVE-2026-43020
  • Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• CVE-2026-31748
  • comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748}
• CVE-2026-31747
  • comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747}
• CVE-2026-31696
  • rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2024-26988
  • init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
• Miscellaneous upstream changes
  • ubuntu20: de-symlink debian/changelog to a real copy
• Bump ABI 5.4.0-232

• smb: client: reject userspace cifs.spnego descriptions
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvme-rdma: fix possible use-after-free in transport error_recovery work {CVE-2022-48788}
• hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
• Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
• cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
• ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• usb: cdc-wdm: avoid setting WDM_READ for ZLP-s {CVE-2026-43427}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50082
  • ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2026-43141
  • ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141}
• CVE-2026-23209
  • macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31532
  • can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• CVE-2026-31688
  • driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• CVE-2023-53680
  • NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• CVE-2025-38718
  • sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2024-42120
  • drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
• CVE-2022-50093
  • iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• CVE-2022-50410
  • NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410}
• CVE-2026-23234
  • f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-43373
  • net: ncsi: fix skb leak in error paths {CVE-2026-43373}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43449
  • nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2022-49770
  • ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• CVE-2026-43283
  • net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283}
• Bump ABI 4.15.0-261

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].

The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds.

BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0

Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
• CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
• CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
• CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
• CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
• CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
• CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo()…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
• CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
• CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
• CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
• CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
• CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
• CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
• CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
• CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
• CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
• CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
• CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
• CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo()…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
• CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
• CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
• CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
• CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
• CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
• CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
• CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
• CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
• CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
• CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
• CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
• CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
• CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
• CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
• CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
• CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
• CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
• CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
• CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…