CVE-2023-53751

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257)
• kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226)
• kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
• md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• netfilter: nf_tables: do not compare internal table flags on updates {CVE-2024-27065}
• init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
• wireguard: netlink: check for dangling peer via is_dead instead of empty list {CVE-2024-26951}
• platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077}
• exfat: fix double free in delayed_free {CVE-2025-38206}
• net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}
• wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write {CVE-2023-54286}
• vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• software node: Correct a OOB check in {CVE-2025-38342}
• nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
• USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
• PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• md/raid10: fix overflow of md/safe_mode_delay
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
• rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
• ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
• RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• RDMA/mlx5: Handle DCT QP logic separately from low level QP interface
• net/mlx5e: Use correct encap attribute during invalidation {CVE-2023-54074}
• net/mlx5: Nullify qp->dbg pointer post destruction
• scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
• net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272}
• ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
• sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
• netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
• wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}

• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• firewire: net: remove unused variable 'guid' {CVE-2023-53432}
• gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
• gfs2: fix kernel…

• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• net: tun: bound receive headroom {CVE-2026-81000}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

• CVE-2026-46267
  • nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267}
• CVE-2026-53004
  • sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• CVE-2026-98716
  • KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716}
• CVE-2026-98714
  • KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded {CVE-2026-98714}
• CVE-2026-98715
  • KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715}
• CVE-2026-98662
  • iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662}
• CVE-2026-98430
  • RDMA/efa: Keep admin queues alive while IRQ is registered {CVE-2026-98430}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
• CVE-2026-98763
  • usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763}
• CVE-2026-46064
  • ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-53149
  • thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• CVE-2026-46163
  • wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}
• CVE-2026-52962
  • ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962}
• CVE-2026-98386
  • scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386}
• CVE-2026-45916
  • power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2023-54243
  • netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243}
• CVE-2026-53255
  • Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255}
• CVE-2026-98409
  • watchdog: rtd119x: Avoid division by zero {CVE-2026-98409}
• CVE-2026-98598
  • ipv6: Prevent rt6_insert_exception() for dying fib6_info. {CVE-2026-98598}
• CVE-2026-53392
  • NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• CVE-2026-98422
  • wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown {CVE-2026-98422}
• CVE-2026-98393
  • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
• CVE-2026-53129
  • fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129}
• CVE-2023-53794
  • cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794}
• CVE-2026-98494
  • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
• CVE-2026-98428
  • ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428}
• CVE-2026-53157
  • net: phonet: free phonet_device after RCU grace period {CVE-2026-53157}
• CVE-2026-98709
  • wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98811
  • net/sched: cls_api: reclaim an empty proto on the error path {CVE-2026-98811}
• CVE-2026-43042
  • mpls: add seqcount to protect the…

Root has patched CVE-2023-53751 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2023-53751 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

• ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
• ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
• ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
• ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
• KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
• RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
• RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
• RDMA/hns: Fix the modification of max_send_sge (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
• RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
• RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
• RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
• RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
• arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
• cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
• cpuidle: Move IRQ state validation (git-fixes).
• cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
• dm: free table mempools if not used in __bind (git-fixes).
• padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
• platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
• x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
• x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
• x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
• x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
• x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
• x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
• x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
• x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
• CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

The following non security issues were fixed:

• x86/CPU/AMD: Add ZenX generations flags (bsc#1238896).
• x86: make page fault handling disable interrupts properly (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50347: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (bsc#1249928).
• CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time (bsc#1252542).
• CVE-2022-50676: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (bsc#1254689).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50709: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (bsc#1255565).
• CVE-2022-50716: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (bsc#1255839).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50719: ALSA: line6: fix stack overflow in line6_midi_transmit (bsc#1255939).
• CVE-2022-50740: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (bsc#1256155).
• CVE-2022-50744: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (bsc#1256165).
• CVE-2022-50749: acct: fix potential integer overflow in encode_comp_t() (bsc#1256191).
• CVE-2022-50751: configfs: fix possible memory leak in configfs_create_dir() (bsc#1256184).
• CVE-2022-50760: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (bsc#1255983).
• CVE-2022-50770: ocfs2: fix memory leak in ocfs2_mount_volume() (bsc#1256221).
• CVE-2022-50777: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (bsc#1256320).
• CVE-2022-50780: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (bsc#1256305).
• CVE-2022-50782: ext4: fix bug_on in __es_tree_search caused by bad quota inode (bsc#1256282).
• CVE-2022-50786: media: s5p-mfc: Clear workbit to handle error condition (bsc#1256258).
• CVE-2022-50816: ipv6: ensure sane device mtu in tunnels (bsc#1256038).
• CVE-2022-50834: nfc: Fix potential resource leaks (bsc#1256219).
• CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (bsc#1256168).
• CVE-2022-50868: hwrng: amd - Fix PCI device refcount leak (bsc#1256386).
• CVE-2022-50880: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (bsc#1256132).
• CVE-2022-50881: ath9k: Fix typo in function name (bsc#1256130).
• CVE-2022-50884: drm: Prevent drm_copy_field() to attempt copying a NULL pointer (bsc#1256127).
• CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (bsc#1256122).
• CVE-2022-50887: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (bsc#1256125).
• CVE-2023-50756: nvme-pci: fix mempool alloc size (bsc#1256216).
• CVE-2023-53685: tun: Fix memory leak for detached NAPI queue (bsc#1251770).
• CVE-2023-53747: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (bsc#1254572).
• CVE-2023-53751: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (bsc#1254986).
• CVE-2023-53825: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() (bsc#1254707).
• CVE-2023-53853: netlink: annotate accesses to nlk->cb_running (bsc#1254673).
• CVE-2023-53863: netlink: do not hard code device address lenth in fdb dumps (bsc#1254657).
• CVE-2023-53992: wifi: cfg80211: ocb: don't leave if not joined (bsc#1256058).
• CVE-2023-54012: net: fix stack overflow when LRO is disabled for virtual interfaces (bsc#1255571).
• CVE-2023-54047: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind (bsc#1256398).
• CVE-2023-54048: RDMA/bnxt_re: Prevent handling any completions after qp destroy (bsc#1256395).
• CVE-2023-54067: btrfs: fix race when deleting free space root from the dirty cow roots list (bsc#1256369).
• CVE-2023-54111: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1256149).
• CVE-2023-54112: kcm: Fix memory leak in error path of kcm_sendmsg() (bsc#1256354).
• CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
• CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
• CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
• CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
• CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
• CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
• CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
• CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
• CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
• CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
• CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
• CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
• CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
• CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
• CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68312: usbnet: Prevents free active kevent (bsc#1255171).
• CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
• CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
• CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
• CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
• CVE-2026-22999: net/sched: sch_qfq: do not free…