CVE-2022-49822

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix connections leak when tlink setup failed If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit. Also leak the fscache info, and for next mount with fsc, it will print the follow errors: CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST) Let's check the result of tlink setup, and do some cleanup.

• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ALSA: usb-audio: Use the right limit for PCM OOB check
• ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
• rcu: Fix rcu_read_unlock() deadloop due to softirq
• rcu: Fix racy re-initialization of irq_work causing hangs
• RDMA/efa: Fix possible deadlock {CVE-2026-31493}
• RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
• RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
• RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
• RDMA/efa: Extend admin timeout error print
• RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
• kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
• exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
• af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
• kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
• smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
• sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
• RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
• drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
• net: hinic: fix memory leak when reading function table {CVE-2022-50438}
• device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
• libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
• net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
• nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
• leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
• bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
• RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
• tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
• kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
• NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
• i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
• can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
• regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
• wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
• netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
• can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
• bpf: Fix…

In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix connections leak when tlink setup failed

If the tlink setup failed, lost to put the connections, then the module refcnt leak since the cifsd kthread not exit.

Also leak the fscache info, and for next mount with fsc, it will print the follow errors: CIFS: Cache volume key already in use (cifs,127.0.0.1:445,TEST)

Let's check the result of tlink setup, and do some cleanup.

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919)
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Remove debug flavor (bsc#1243919).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49110: netfilter: conntrack: revisit gc autotuning (bsc#1237981).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49767: 9p/trans_fd: always use O_NONBLOCK read/write (bsc#1242493).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49858: octeontx2-pf: Fix SQE threshold checking (bsc#1242589).
• CVE-2023-53058: net/mlx5: E-Switch, Fix an Oops in error handling code (bsc#1242237).
• CVE-2023-53060: igb: revert rtnl_lock() that causes deadlock (bsc#1242241).
• CVE-2023-53064: iavf: Fix hang on reboot with ice (bsc#1242222).
• CVE-2023-53066: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info (bsc#1242227).
• CVE-2023-53079: net/mlx5: Fix steering rules cleanup (bsc#1242765).
• CVE-2023-53114: i40e: Fix kernel crash during reboot when adapter is in recovery mode (bsc#1242398).
• CVE-2023-53134: bnxt_en: Avoid order-5 memory allocation for TPA data (bsc#1242380)
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21888: RDMA/mlx5: Fix a WARN during dereg_mr for DM type (bsc#1240177).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22060: net: mvpp2: Prevent parser TCAM memory corruption (bsc#1241526).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).

The following non-security bugs were fixed:

• Refresh fixes for cBPF issue (bsc#1242778)
• Remove debug flavor (bsc#1243919).
• Update metadata and put them into the sorted part of the series
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2024-53168: net: make sock_inuse_add() available (bsc#1234887).
• CVE-2024-56558: nfsd: make sure exp active before svc_export_show (bsc#1235100).
• CVE-2025-21999: proc: fix UAF in proc_get_inode() (bsc#1240802).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2024-28956: x86/its: Add support for ITS-safe indirect thunk (bsc#1242006).
• CVE-2025-37785: ext4: fix OOB read when checking dotdot dir (bsc#1241640).

The following non-security bugs were fixed:

• Drivers: hv: Allow vmbus_sendpacket_mpb_desc() to create multiple ranges (bsc#1243737).
• Move upstreamed sched/membarrier patch into sorted section
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.4 anymore.
• Remove debug flavor (bsc#1243919). This is only released in Leap, and we do not have Leap 15.5 anymore.
• Use gcc-13 for build on SLE16 (jsc#PED-10028).
• arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (bsc#1242778).
• arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (bsc#1242778).
• arm64: insn: Add support for encoding DSB (bsc#1242778).
• arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (bsc#1242778).
• arm64: proton-pack: Expose whether the branchy loop k value (bsc#1242778).
• arm64: proton-pack: Expose whether the platform is mitigated by firmware (bsc#1242778).
• hv_netvsc: Preserve contiguous PFN grouping in the page buffer array (bsc#1243737).
• hv_netvsc: Remove rmsg_pgcnt (bsc#1243737).
• hv_netvsc: Use vmbus_sendpacket_mpb_desc() to send VMBus messages (bsc#1243737).
• mtd: phram: Add the kernel lock down check (bsc#1232649).
• net :mana :Add remaining GDMA stats for MANA to ethtool (bsc#1234395).
• net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (bsc#1234395).
• net: mana: Add gdma stats to ethtool output for mana (bsc#1234395).
• nvme-pci: acquire cq_poll_lock in nvme_poll_irqdisable (bsc#1223096).
• ocfs2: fix the issue with discontiguous allocation in the global_bitmap (git-fixes).
• powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (bsc#1218470 ltc#204531).
• rpm/kernel-binary.spec.in: Also order against update-bootloader (boo#1228659, boo#1240785, boo#1241038).
• rpm/kernel-binary.spec.in: Fix missing 20-kernel-default-extra.conf (bsc#1239986)
• rpm/kernel-binary.spec.in: fix KMPs build on 6.13+ (bsc#1234454)
• rpm/kernel-docs.spec.in: Workaround for reproducible builds (bsc#1238303)
• rpm/release-projects: Update the ALP projects again (bsc#1231293).
• rpm/split-modules: Fix optional splitting with usrmerge (bsc#1238570)
• scsi: core: Fix unremoved procfs host directory regression (git-fixes).
• tcp: Dump bound-only sockets in inet_diag (bsc#1204562).
• tpm, tpm_tis: Workaround failed command reception on Infineon devices (bsc#1235870).
• tpm: tis: Double the timeout B to 4s (bsc#1235870).
• x86/bhi: Do not set BHI_DIS_S in 32-bit mode (bsc#1242778).
• x86/bpf: Add IBHF call at end of classic BPF (bsc#1242778).
• x86/bpf: Call branch history clearing sequence on exit (bsc#1242778).