CVE-2022-50496

In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy() Dm_cache also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in destroy().

• wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
• virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• netfilter: validate user input for expected length {CVE-2024-35896}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path…

• xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• dm cache: Fix UAF in destroy() {CVE-2022-50496}
• Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
• xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
• Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
• NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
• NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
• mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
• fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• i40e: remove read access to debugfs files {CVE-2025-39901}
• Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• iavf: Fix use-after-free in free_netdev {CVE-2023-53556}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
• net/sched: act_mirred: don't override retval if we already lost the skb…

• CVE-2025-39743
  • jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
• CVE-2025-39685
  • comedi: pcl726: Prevent invalid irq number {CVE-2025-39685}
• CVE-2025-38713
  • hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-38713}
• CVE-2025-38699
  • scsi: bfa: Double-free fix {CVE-2025-38699}
• CVE-2025-38697
  • jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
• CVE-2025-38680
  • media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• CVE-2025-38677
  • f2fs: fix to avoid out-of-boundary access in dnode page {CVE-2025-38677}
• CVE-2025-38572
  • ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• CVE-2025-38538
  • dmaengine: nbpfaxi: Fix memory corruption in probe() {CVE-2025-38538}
• CVE-2025-38530
  • comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
• CVE-2025-38529
  • comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
• CVE-2025-38494
  • HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• CVE-2025-38482
  • comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
• CVE-2025-38428
  • Input: ims-pcu - check record size in ims_pcu_flash_firmware() {CVE-2025-38428}
• CVE-2025-38416
  • NFC: nci: uart: Set tty->disc_data only in success path {CVE-2025-38416}
• CVE-2025-38415
  • Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• CVE-2025-38403
  • vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
• CVE-2025-38286
  • pinctrl: at91: Fix possible out-of-boundary access {CVE-2025-38286}
• CVE-2025-38245
  • atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• CVE-2025-38212
  • ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
• CVE-2025-38204
  • jfs: fix array-index-out-of-bounds read in add_missing_indices {CVE-2025-38204}
• CVE-2025-38157
  • wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• CVE-2025-38079
  • crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• CVE-2025-38051
  • smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• CVE-2023-53676
  • scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• CVE-2023-53675
  • scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• CVE-2023-53668
  • ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• CVE-2023-53622
  • gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• CVE-2023-53616
  • jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
• CVE-2023-53608
  • nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
• CVE-2023-53587
  • ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• CVE-2023-53569
  • ext2: Check block size validity during mount {CVE-2023-53569}
• CVE-2023-53559
  • ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• CVE-2023-53541
  • mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
• CVE-2023-53521
  • scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
• CVE-2023-53506
  • udf: Do not bother merging very long extents {CVE-2023-53506}
• CVE-2023-53485
  • fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev {CVE-2023-53485}
• CVE-2023-53484
  • lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• CVE-2023-53454
  • HID: multitouch: Correct devm device reference for hidinput input_dev name…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

In the Linux kernel, the following vulnerability has been resolved:

dm cache: Fix UAF in destroy()

Dm_cache also has the same UAF problem when dm_resume() and dm_destroy() are concurrent.

Therefore, cancelling timer again in destroy().

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
• CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

The following non security issues were fixed:

• fbcon: Fix OOB access in font allocation (bsc#1252033)
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

The SUSE Linux Enterprise FIXME kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50388: nvme: fix multipath crash caused by flush request when blktrace is enabled (bsc#1250293).
• CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
• CVE-2022-50432: kernfs: fix use-after-free in __kernfs_remove (bsc#1250851).
• CVE-2022-50488: block, bfq: fix possible uaf for 'bfqq->bic' (bsc#1251201).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2023-53722: md: raid1: fix potential OOB in raid1_remove_disk() (bsc#1252499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).
• CVE-2025-40088: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (bsc#1252904).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).

The following non security issues were fixed:

• fbcon: Fix OOB access in font allocation (bsc#1252033)
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

The following non security issues were fixed:

• NFS: remove revoked delegation from server's delegation list (bsc#1246211).
• NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• fbcon: Fix OOB access in font allocation (bsc#1252033)
• kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
• net: mana: Switch to page pool for jumbo frames (bsc#1248754).
• net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).
• netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237). No CVE available yet, please see the bugzilla ticket referenced.

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50388: nvme: fix multipath crash caused by flush request when blktrace is enabled (bsc#1250293).
• CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
• CVE-2022-50432: kernfs: fix use-after-free in __kernfs_remove (bsc#1250851).
• CVE-2022-50488: block, bfq: fix possible uaf for 'bfqq->bic' (bsc#1251201).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (bsc#1250358).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2023-53722: md: raid1: fix potential OOB in raid1_remove_disk() (bsc#1252499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-4460: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning (bsc#1250764).
• CVE-2022-48631: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (bsc#1223475).
• CVE-2022-50236: iommu/mediatek: Fix crash on isr after kexec() (bsc#1249702).
• CVE-2022-50249: memory: of: Fix refcount leak bug in of_get_ddr_timings() (bsc#1249747).
• CVE-2022-50280: pnode: terminate at peers of source (bsc#1249806).
• CVE-2022-50293: btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range (bsc#1249752).
• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50350: scsi: target: iscsi: Fix a race condition between login_work and the login thread (bsc#1250261).
• CVE-2022-50356: net: sched: sfb: fix null pointer access issue when sfb_init() fails (bsc#1250040).
• CVE-2022-50367: fs: fix UAF/GPF bug in nilfs_mdt_destroy (bsc#1250277).
• CVE-2022-50394: i2c: ismt: Fix an out-of-bounds bug in ismt_access() (bsc#1250107).
• CVE-2022-50395: integrity: Fix memory leakage in keyring allocation error path (bsc#1250211).
• CVE-2022-50423: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() (bsc#1250784).
• CVE-2022-50443: drm/rockchip: lvds: fix PM usage counter unbalance in poweron (bsc#1250768).
• CVE-2022-50459: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() (bsc#1250850).
• CVE-2022-50481: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() (bsc#1251051).
• CVE-2022-50485: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (bsc#1251197).
• CVE-2022-50505: iommu/amd: Fix pci device refcount leak in ppr_notifier() (bsc#1251086).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback() (bsc#1251330).
• CVE-2022-50571: btrfs: call __btrfs_remove_free_space_cache_locked on cache load failure (bsc#1252487).
• CVE-2023-53183: btrfs: exit gracefully if reloc roots don't match (bsc#1249863).
• CVE-2023-53185: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (bsc#1249820).
• CVE-2023-53188: net: openvswitch: fix race on port output (bsc#1249854).
• CVE-2023-53191: irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains (bsc#1249721).
• CVE-2023-53204: af_unix: Fix data-races around user->unix_inflight (bsc#1249682).
• CVE-2023-53271: ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() (bsc#1249916).
• CVE-2023-53282: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write (bsc#1250311).
• CVE-2023-53289: media: bdisp: Add missing check for create_workqueue (bsc#1249941).
• CVE-2023-53292: blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none (bsc#1250163).
• CVE-2023-53338: lwt: Fix return values of BPF xmit ops (bsc#1250074).
• CVE-2023-53339: btrfs: fix BUG_ON condition in btrfs_cancel_balance (bsc#1250329).
• CVE-2023-53373: crypto: seqiv - Handle EBUSY correctly (bsc#1250137).
• CVE-2023-53433: net: add vlan_get_protocol_and_depth() helper (bsc#1250164).
• CVE-2023-53476: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() (bsc#1250839).
• CVE-2023-53477: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (bsc#1250840).
• CVE-2023-53484: lib: cpu_rmap: Avoid use after free on rmap->obj array entries (bsc#1250895).
• CVE-2023-53517: tipc: do not update mtu if msg_max is too small in mtu negotiation (bsc#1250919).
• CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy (bsc#1250964).
• CVE-2023-53540: wifi: cfg80211: reject auth/assoc to AP with our address (bsc#1251053).
• CVE-2023-53548: net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (bsc#1251066).
• CVE-2023-53556: iavf: Fix use-after-free in free_netdev (bsc#1251059). -…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50327: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (bsc#1249859).
• CVE-2022-50334: hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() (bsc#1249857).
• CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace (bsc#1251164).
• CVE-2022-50516: fs: dlm: fix invalid derefence of sb_lvbptr (bsc#1251741).
• CVE-2023-53365: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (bsc#1249988).
• CVE-2023-53500: xfrm: fix slab-use-after-free in decode_session6 (bsc#1250816).
• CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6 (bsc#1251052).
• CVE-2023-53574: wifi: rtw88: delete timer and free skb queue when unloading (bsc#1251222).
• CVE-2023-53619: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (bsc#1251743).
• CVE-2023-53673: Bluetooth: hci_event: call disconnect callback before deleting conn (bsc#1251763).
• CVE-2023-53705: ipv6: Fix out-of-bounds access in ipv6_find_tlv() (bsc#1252554).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-38084: hugetlb: unshare some PMDs when splitting VMAs (bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245499).
• CVE-2025-38476: rpl: Fix use-after-free in rpl_do_srh_inline() (bsc#1247317).
• CVE-2025-39742: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() (bsc#1249479).
• CVE-2025-39797: xfrm: Duplicate SPI Handling (bsc#1249608).
• CVE-2025-39945: cnic: Fix use-after-free bugs in cnic_delete_task (bsc#1251230).
• CVE-2025-39967: fbcon: fix integer overflow in fbcon_do_set_font (bsc#1252033).
• CVE-2025-39968: i40e: add max boundary check for VF filters (bsc#1252047).
• CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252035).
• CVE-2025-39978: octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() (bsc#1252069).
• CVE-2025-39981: Bluetooth: MGMT: Fix possible UAFs (bsc#1252060).
• CVE-2025-40018: ipvs: Defer ip_vs_ftp unregister during netns cleanup (bsc#1252688).
• CVE-2025-40044: fs: udf: fix OOB read in lengthAllocDescs handling (bsc#1252785).

The following non security issues were fixed:

• NFS: remove revoked delegation from server's delegation list (bsc#1246211).
• NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• fbcon: Fix OOB access in font allocation (bsc#1252033)
• kabi fix for NFSv4: Allow FREE_STATEID to clean up delegations (bsc#1246211).
• kernel-subpackage-spec: Do not doubly-sign modules (bsc#1251930).
• mm: avoid unnecessary page fault retires on shared memory types (bsc#1251823).
• net: hv_netvsc: fix loss of early receive events from host during channel open (bsc#1252265).
• net: mana: Switch to page pool for jumbo frames (bsc#1248754).
• net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency (bsc#1248754).
• netfilter: nft_objref: validate objref and objrefmap expressions (bsc#1250237).
• rpm/check-for-config-changes: ignore CONFIG_SCHED_PROXY_EXEC, too (bsc#1250946)