CVE-2024-42103

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused list. Since the block group is removed from the reclaim list and it is on a relocation work, it can be added into the unused list in parallel. When that happens, adding it to the reclaim list will corrupt the list head and trigger list corruption like below.

Fix it by taking fs_info->unused_bgs_lock.

[177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104 [177.514][T2585409] list_del corruption. next->prev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0) [177.529][T2585409] ------------[ cut here ]------------ [177.537][T2585409] kernel BUG at lib/list_debug.c:65! [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G W 6.10.0-rc5-kts #1 [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022 [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs] [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72 [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286 [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000 [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40 [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08 [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0 [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000 [177.687][T2585409] FS: 0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000 [177.700][T2585409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0 [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000 [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400 [177.742][T2585409] PKRU: 55555554 [177.748][T2585409] Call Trace: [177.753][T2585409] <TASK> [177.759][T2585409] ? __die_body.cold+0x19/0x27 [177.766][T2585409] ? die+0x2e/0x50 [177.772][T2585409] ? do_trap+0x1ea/0x2d0 [177.779][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.788][T2585409] ? do_error_trap+0xa3/0x160 [177.795][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.805][T2585409] ? handle_invalid_op+0x2c/0x40 [177.812][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.820][T2585409] ? exc_invalid_op+0x2d/0x40 [177.827][T2585409] ? asm_exc_invalid_op+0x1a/0x20 [177.834][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.843][T2585409] btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs]

There is a similar retry_list code in btrfs_delete_unused_bgs(), but it is safe, AFAICS. Since the block group was in the unused list, the used bytes should be 0 when it was added to the unused list. Then, it checks block_group->{used,reserved,pinned} are still 0 under the block_group->lock. So, they should be still eligible for the unused list, not the reclaim list.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

That means no other task can allocate from the block group, so while we are at deleted_unused_bgs() it's not possible for other tasks to allocate and deallocate extents from the block group, so it can't be added to the unused list or the reclaim list by anyone else.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.25%Up 0.2 points since Jul 30, 2024

What each source reports

CVE List Score used 7.8

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

Fix it by taking fs_info->unused_bgs_lock.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: CVE-2024-42103
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2024-39935 7.8

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

Fix it by taking fs_info->unused_bgs_lock.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: EUVD-2024-39935
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qj52-rm77-v6ch 5.5

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block...

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

Fix it by taking fs_info->unused_bgs_lock.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: GHSA-qj52-rm77-v6ch
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

Fix it by taking fs_info->unused_bgs_lock.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: CVE-2024-42103
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-42103 5.5

Record: BELL-CVE-2024-42103
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.8

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix adding block group to a reclaim list and the unused list during reclaim

Fix it by taking fs_info->unused_bgs_lock.

The reason it is safe there it's because because we're holding space_info->groups_sem in write mode.

The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: CVE-2024-42103
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 23 moreShow less

OSVDEBIAN-CVE-2024-42103 5.5

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block group to a reclaim list and the unused list during reclaim There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused list. Since the block group is removed from the reclaim list and it is on a relocation work, it can be added into the unused list in parallel. When that happens, adding it to the reclaim list will corrupt the list head and trigger list corruption like below. Fix it by taking fs_info->unused_bgs_lock. [177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104 [177.514][T2585409] list_del corruption. next->prev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0) [177.529][T2585409] ------------[ cut here ]------------ [177.537][T2585409] kernel BUG at lib/list_debug.c:65! [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G W 6.10.0-rc5-kts #1 [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022 [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs] [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72 [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286 [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000 [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40 [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08 [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0 [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000 [177.687][T2585409] FS: 0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000 [177.700][T2585409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0 [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000 [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400 [177.742][T2585409] PKRU: 55555554 [177.748][T2585409] Call Trace: [177.753][T2585409] <TASK> [177.759][T2585409] ? __die_body.cold+0x19/0x27 [177.766][T2585409] ? die+0x2e/0x50 [177.772][T2585409] ? do_trap+0x1ea/0x2d0 [177.779][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.788][T2585409] ? do_error_trap+0xa3/0x160 [177.795][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.805][T2585409] ? handle_invalid_op+0x2c/0x40 [177.812][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.820][T2585409] ? exc_invalid_op+0x2d/0x40 [177.827][T2585409] ? asm_exc_invalid_op+0x1a/0x20 [177.834][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.843][T2585409] btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs] There is a similar retry_list code in btrfs_delete_unused_bgs(), but it is safe, AFAICS. Since the block group was in the unused list, the used bytes should be 0 when it was added to the unused list. Then, it checks block_group->{used,reserved,pinned} are still 0 under the block_group->lock. So, they should be still eligible for the unused list, not the reclaim list. The reason it is safe there it's because because we're holding space_info->groups_sem in write mode. That means no other task can allocate from the block group, so while we are at deleted_unused_bgs() it's not possible for other tasks to allocate and deallocate extents from the block group, so it can't be added to the unused list or the reclaim list by anyone else. The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.

Record: DEBIAN-CVE-2024-42103
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2024-2076 8.2

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound

Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path.

WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_mc_loop+0x2d/0x70 Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? __warn (kernel/panic.c:693) ? sk_mc_loop (net/core/sock.c:760) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:239) ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? sk_mc_loop (net/core/sock.c:760) ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) ? nf_hook_slow (net/netfilter/core.c:626) ip6_finish_output (net/ipv6/ip6_output.c:222) ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan dev_hard_start_xmit (net/core/dev.c:3594) sch_direct_xmit (net/sched/sch_generic.c:343) __qdisc_run (net/sched/sch_generic.c:416) net_tx_action (net/core/dev.c:5286) handle_softirqs (kernel/softirq.c:555) __irq_exit_rcu (kernel/softirq.c:589) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043)

The warning triggers as this: packet_sendmsg packet_snd //skb->sk is packet sk __dev_queue_xmit __dev_xmit_skb //q->enqueue is not NULL __qdisc_run sch_direct_xmit dev_hard_start_xmit ipvlan_start_xmit ipvlan_xmit_mode_l3 //l3 mode ipvlan_process_outbound //vepa flag ipvlan_process_v6_outbound ip6_local_out __ip6_finish_output ip6_finish_output2 //multicast packet sk_mc_loop //sk->sk_family is AF_PACKET

Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.(CVE-2024-33621)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: don't allow unaligned truncation on released compress inode

f2fs image may be corrupted after below testcase:

mkfs.f2fs -O extra_attr,compression -f /dev/vdb
mount /dev/vdb /mnt/f2fs
touch /mnt/f2fs/file
f2fs_io setflags compression /mnt/f2fs/file
dd if=/dev/zero of=/mnt/f2fs/file bs=4k count=4
f2fs_io release_cblocks /mnt/f2fs/file
truncate -s 8192 /mnt/f2fs/file
umount /mnt/f2fs
fsck.f2fs /dev/vdb

[ASSERT] (fsck_chk_inode_blk:1256) --> ino: 0x5 has i_blocks: 0x00000002, but has 0x3 blocks [FSCK] valid_block_count matching with CP [Fail] [0x4, 0x5] [FSCK] other corrupted bugs …

Record: OESA-2024-2076
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-42103 5.5

Record: UBUNTU-CVE-2024-42103
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2024-0277 No score

Updated kernel, kmod-xtables-addons & kmod-virtualbox packages fix security vulnerabilities

Upstream kernel version 6.6.43 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

Record: MGASA-2024-0277
Updated: 2026-11-02

OSVMGASA-2024-0278 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.43 fix bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2024-0278
Updated: 2026-11-02

OSVSUSE-SU-2026:0447-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
CVE-2025-68768: inet:…

Record: SUSE-SU-2026:0447-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0471-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
CVE-2026-22999: net/sched: sch_qfq: do not free existing class in qfq_change_class() (bsc#1257236).
CVE-2026-23001: macvlan: fix possible UAF in macvlan_forward_source() (bsc#1257232).
CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).

The following non security issues were fixed:

bpf/selftests: test_select_reuseport_kern: Remove unused header (bsc#1257603).
btrfs: do not strictly require dirty metadata threshold for metadata writepages (stable-fixes).
cifs: Fix copy offload to flush destination region (bsc#1252511).
cifs: Fix flushing, invalidation and file size with copy_file_range() (bsc#1252511).
cifs: add new field to track the last access time of cfid (git-fixes).
ext4: use optimized mballoc scanning regardless of inode format (bsc#1254378).
ice: use netif_get_num_default_rss_queues() (bsc#1247712).
mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (bsc#1253087).
net: hv_netvsc: reject RSS hash key programming without RX indirection table (bsc#1257473).
net: tcp: allow zero-window ACK update the window (bsc#1254767).
sched: Increase sched_tick_remote timeout (bsc#1254510).
scsi: storvsc: Process unsupported MODE_SENSE_10 (bsc#1257296).
smb: change return type of cached_dir_lease_break() to bool (git-fixes).
smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (git-fixes).
smb: client: remove unused fid_lock (git-fixes).
smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (git-fixes).
smb: client: split cached_fid bitfields to avoid shared-byte RMW races (bsc#1250748).
smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (git-fixes).
smb: improve directory cache reuse for readdir operations (bsc#1252712).
x86: make page fault handling disable interrupts properly (git-fixes).

Record: SUSE-SU-2026:0471-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0472-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
CVE-2025-68768: inet:…

Record: SUSE-SU-2026:0472-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0587-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
CVE-2025-68768: inet:…

Record: SUSE-SU-2026:0587-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20498-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20498-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20876-1
Updated: 2026-11-02

OSVUSN-7089-1 No score

linux, linux-gcp-6.8, linux-hwe-6.8 vulnerabilities

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)