CVE-2025-21881

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'

All error handling paths lead to 'out' where many resources are freed.

Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak.(CVE-2021-47660)

In the Linux kernel, the following vulnerability has been resolved:

list: fix a data-race around ep->rdllist

ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.

Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.

Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless.

BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait

write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88810480c7d0 -> 0xffff888103c15098

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011(CVE-2022-49443)

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: governor: Use kobject release() method to free dbs_data

The struct dbs_data embeds a struct gov_attr_set and the struct gov_attr_set embeds a kobject. Since every kobject must have a release() method and we can't use kfree() to free it directly, so introduce cpufreq_dbs_data_release() to release the dbs_data via the kobject::release() method. This fixes the calltrace like below:

ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x34 WARNING: CPU: 12 PID: 810 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 12 PID: 810 Comm: sh Not tainted 5.16.0-next-20220120-yocto-standard+ #536 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001dfcf9a0 x29: ffff80001dfcf9a0 x28:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'

All error handling paths lead to 'out' where many resources are freed.

Do it as well here instead of a direct return, otherwise 'log', 'ra' and 'log->one_page_buf' (at least) will leak.(CVE-2021-47660)

In the Linux kernel, the following vulnerability has been resolved:

list: fix a data-race around ep->rdllist

ep_poll() first calls ep_events_available() with no lock held and checks if ep->rdllist is empty by list_empty_careful(), which reads rdllist->prev. Thus all accesses to it need some protection to avoid store/load-tearing.

Note INIT_LIST_HEAD_RCU() already has the annotation for both prev and next.

Commit bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") added the first lockless ep_events_available(), and commit c5a282e9635e ("fs/epoll: reduce the scope of wq lock in epoll_wait()") made some ep_events_available() calls lockless and added single call under a lock, finally commit e59d3c64cba6 ("epoll: eliminate unnecessary lock for zero timeout") made the last ep_events_available() lockless.

BUG: KCSAN: data-race in do_epoll_wait / do_epoll_wait

write to 0xffff88810480c7d8 of 8 bytes by task 1802 on cpu 0: INIT_LIST_HEAD include/linux/list.h:38 [inline] list_splice_init include/linux/list.h:492 [inline] ep_start_scan fs/eventpoll.c:622 [inline] ep_send_events fs/eventpoll.c:1656 [inline] ep_poll fs/eventpoll.c:1806 [inline] do_epoll_wait+0x4eb/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810480c7d8 of 8 bytes by task 1799 on cpu 1: list_empty_careful include/linux/list.h:329 [inline] ep_events_available fs/eventpoll.c:381 [inline] ep_poll fs/eventpoll.c:1797 [inline] do_epoll_wait+0x279/0xf40 fs/eventpoll.c:2234 do_epoll_pwait fs/eventpoll.c:2268 [inline] __do_sys_epoll_pwait fs/eventpoll.c:2281 [inline] __se_sys_epoll_pwait+0x12b/0x240 fs/eventpoll.c:2275 __x64_sys_epoll_pwait+0x74/0x80 fs/eventpoll.c:2275 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88810480c7d0 -> 0xffff888103c15098

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 1799 Comm: syz-fuzzer Tainted: G W 5.17.0-rc7-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011(CVE-2022-49443)

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: governor: Use kobject release() method to free dbs_data

The struct dbs_data embeds a struct gov_attr_set and the struct gov_attr_set embeds a kobject. Since every kobject must have a release() method and we can't use kfree() to free it directly, so introduce cpufreq_dbs_data_release() to release the dbs_data via the kobject::release() method. This fixes the calltrace like below:

ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x34 WARNING: CPU: 12 PID: 810 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 12 PID: 810 Comm: sh Not tainted 5.16.0-next-20220120-yocto-standard+ #536 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001dfcf9a0 x29: ffff80001dfcf9a0 x28:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.(CVE-2024-53162)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of signing key

Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race:

task A task B cifs_mount() dfs_mount_share() get_session() cifs_mount_get_session() cifs_send_recv() cifs_get_smb_ses() compound_send_recv() cifs_setup_session() smb2_setup_request() kfree_sensitive() smb2_calc_signature() crypto_shash_setkey() UAF

Fix this by ensuring that we have a valid @ses->auth_key.response by checking whether @ses->ses_status is SES_GOOD or SES_EXITING with @ses->ses_lock held. After commit 24a9799aa8ef ("smb: client: fix UAF in smb2_reconnect_server()"), we made sure to call ->logoff() only when @ses was known to be good (e.g. valid ->auth_key.response), so it's safe to access signing key when @ses->ses_status == SES_EXITING.(CVE-2024-53179)

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: bsg: Set bsg_queue to NULL after removal

Currently, this does not cause any issues, but I believe it is necessary to set bsg_queue to NULL after removing it to prevent potential use-after-free (UAF) access.(CVE-2024-54458)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Play nice with protected guests in complete_hypercall_exit()

Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For guests with protected state, e.g. SEV-ES and SEV-SNP, KVM must assume the hypercall was made in 64-bit mode as the vCPU state needed to detect 64-bit mode is unavailable.

Hacking the sev_smoke_test selftest to generate a KVM_HC_MAP_GPA_RANGE hypercall via VMGEXIT trips the WARN:

------------[ cut here ]------------ WARNING: CPU: 273 PID: 326626 at arch/x86/kvm/x86.h:180 complete_hypercall_exit+0x44/0xe0 [kvm] Modules linked in: kvm_amd kvm ... [last unloaded: kvm] CPU: 273 UID: 0 PID: 326626 Comm: sev_smoke_test Not tainted 6.12.0-smp--392e932fa0f3-feat…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans

There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative.

[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative

Ensuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to shrink read extent node in batches

We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tree, during shrink of extent tree, it may hold rwlock for a very long time, which may trigger kernel hang issue.

This patch fixes to shrink read extent node in batches, so that, critical region of the rwlock can be shrunk to avoid its extreme long time hold.(CVE-2024-41935)

In the Linux kernel, the following vulnerability has been resolved:

vrf: revert "vrf: Remove unnecessary RCU-bh critical section"

This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853.

dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following:

    /* Disable soft irqs for various locks below. Also
     * stops preemption for RCU.
     */
    rcu_read_lock_bh();

VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning:

================================
WARNING: inconsistent lock state
6.11.0 #1 Tainted: G        W
--------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
btserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30
{IN-SOFTIRQ-W} state was registered at:
  lock_acquire+0x19a/0x4f0
  _raw_spin_lock+0x27/0x40
  packet_rcv+0xa33/0x1320
  __netif_receive_skb_core.constprop.0+0xcb0/0x3a90
  __netif_receive_skb_list_core+0x2c9/0x890
  netif_receive_skb_list_internal+0x610/0xcc0
      [...]

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(rlock-AF_PACKET);
  <Interrupt>
    lock(rlock-AF_PACKET);

 *** DEADLOCK ***

Call Trace:
 <TASK>
 dump_stack_lvl+0x73/0xa0
 mark_lock+0x102e/0x16b0
 __lock_acquire+0x9ae/0x6170
 lock_acquire+0x19a/0x4f0
 _raw_spin_lock+0x27/0x40
 tpacket_rcv+0x863/0x3b30
 dev_queue_xmit_nit+0x709/0xa40
 vrf_finish_direct+0x26e/0x340 [vrf]
 vrf_l3_out+0x5f4/0xe80 [vrf]
 __ip_local_out+0x51e/0x7a0
      [...](CVE-2024-49980)

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit()

The "submit->cmd[i].size" and "submit->cmd[i].offset" variables are u32 values that come from the user via the submit_lookup_cmds() function. This addition could lead to an integer wrapping bug so use size_add() to prevent that.

Patchwork: https://patchwork.freedesktop.org/patch/624696/(CVE-2024-52559)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr()

Extended the mi_enum_attr() function interface with an additional parameter, struct ntfs_inode *ni, to allow marking the inode as bad as soon as an error is detected.(CVE-2024-52560)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

The fw_objs[] array has "num_objs" elements so the > needs to be >= to…

Root has patched CVE-2025-21881 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-21881 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-21881 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: uprobes: Reject the shared zeropage in uprobe_write_opcode() We triggered the following crash in syzkaller tests: BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2 BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1 The following syzkaller test case can be used to reproduce: r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40) The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount. Therefore, two bugs are introduced: 1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count". 2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state". There is more, the following warning could also theoretically be triggered: __replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio) Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote(). [ mingo: Cleaned up the changelog ]

In the Linux kernel, the following vulnerability has been resolved:

uprobes: Reject the shared zeropage in uprobe_write_opcode()

We triggered the following crash in syzkaller tests:

BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2

BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1

The following syzkaller test case can be used to reproduce:

r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40)

The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount.

Therefore, two bugs are introduced:

1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count".

2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state".

There is more, the following warning could also theoretically be triggered:

__replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio)

Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote().

[ mingo: Cleaned up the changelog ]

• net: skbuff: propagate shared-frag marker through pskb_copy()
• mptcp: always handle address removal under msk socket lock {CVE-2025-21875}
• uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
• net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
• wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() {CVE-2025-21744}
• mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
• bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
• blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
• net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
• USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• ice: fix memory leak in aRFS after reset {CVE-2025-21981}
• KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
• Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
• regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
• acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
• drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
• nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
• net: decrease cached dst counters in dst_release {CVE-2025-22057}
• bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
• net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
• dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
• drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
• net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
• drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params {CVE-2025-21941}
• drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities {CVE-2025-39707}
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• usb: net: sierra: check for no status endpoint {CVE-2025-38474}
• drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
• wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
• netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
• vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
• thermal: int340x: Add NULL check for adev {CVE-2025-23136}
• Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
• dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
• tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
• usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
• bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
• ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
• dm-stripe: fix a possible integer overflow {CVE-2025-39940}
• usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
• fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• posix-clock: Fix missing timespec64 check in pc_clock_settime() {CVE-2024-50195}
• net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
• mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
• RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow…

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

In the Linux kernel, the following vulnerability has been resolved:

uprobes: Reject the shared zeropage in uprobe_write_opcode()

We triggered the following crash in syzkaller tests:

BUG: Bad page state in process syz.7.38 pfn:1eff3 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eff3 flags: 0x3fffff00004004(referenced|reserved|node=0|zone=1|lastcpupid=0x1fffff) raw: 003fffff00004004 ffffe6c6c07bfcc8 ffffe6c6c07bfcc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x32/0x50 bad_page+0x69/0xf0 free_unref_page_prepare+0x401/0x500 free_unref_page+0x6d/0x1b0 uprobe_write_opcode+0x460/0x8e0 install_breakpoint.part.0+0x51/0x80 register_for_each_vma+0x1d9/0x2b0 __uprobe_register+0x245/0x300 bpf_uprobe_multi_link_attach+0x29b/0x4f0 link_create+0x1e2/0x280 __sys_bpf+0x75f/0xac0 __x64_sys_bpf+0x1a/0x30 do_syscall_64+0x56/0x100 entry_SYSCALL_64_after_hwframe+0x78/0xe2

BUG: Bad rss-counter state mm:00000000452453e0 type:MM_FILEPAGES val:-1

The following syzkaller test case can be used to reproduce:

r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) write$nbd(r2, &(0x7f0000000580)=ANY=[], 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x42, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) r5 = userfaultfd(0x80801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x2}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffd000/0x1000)=nil, 0x1000}}) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x2, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000120000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r7, 0x0, 0x30, 0x1e, @val=@uprobe_multi={&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=[0x2], 0x0, 0x0, 0x1}}, 0x40)

The cause is that zero pfn is set to the PTE without increasing the RSS count in mfill_atomic_pte_zeropage() and the refcount of zero folio does not increase accordingly. Then, the operation on the same pfn is performed in uprobe_write_opcode()->__replace_page() to unconditional decrease the RSS count and old_folio's refcount.

Therefore, two bugs are introduced:

1. The RSS count is incorrect, when process exit, the check_mm() report error "Bad rss-count".

2. The reserved folio (zero folio) is freed when folio->refcount is zero, then free_pages_prepare->free_page_is_bad() report error "Bad page state".

There is more, the following warning could also theoretically be triggered:

__replace_page() -> ... -> folio_remove_rmap_pte() -> VM_WARN_ON_FOLIO(is_zero_folio(folio), folio)

Considering that uprobe hit on the zero folio is a very rare case, just reject zero old folio immediately after get_user_page_vma_remote().

[ mingo: Cleaned up the changelog ]

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47659: drm/plane: Move range check for format_count earlier (bsc#1237839).
• CVE-2022-49044: dm integrity: fix memory corruption when tag_size is less than digest size (bsc#1237840).
• CVE-2022-49055: drm/amdkfd: Check for potential null return of kmalloc_array() (bsc#1237868).
• CVE-2022-49060: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() (bsc#1237845).
• CVE-2022-49086: net: openvswitch: fix leak of nested actions (bsc#1238037).
• CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
• CVE-2022-49118: scsi: hisi_sas: Free irq vectors in order for v3 HW (bsc#1237979).
• CVE-2022-49121: scsi: pm8001: Fix tag leaks on error (bsc#1237926).
• CVE-2022-49137: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj (bsc#1238155).
• CVE-2022-49175: PM: core: keep irq flags in device_pm_check_callbacks() (bsc#1238099).
• CVE-2022-49176: bfq: fix use-after-free in bfq_dispatch_request (bsc#1238097).
• CVE-2022-49179: block, bfq: do not move oom_bfqq (bsc#1238092).
• CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region (bsc#1238138).
• CVE-2022-49197: af_netlink: Fix shift out of bounds in group mask calculation (bsc#1238455).
• CVE-2022-49205: bpf, sockmap: Fix double uncharge the mem of sk_msg (bsc#1238335).
• CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() (bsc#1238139).
• CVE-2022-49290: mac80211: fix potential double free on mesh join (bsc#1238156).
• CVE-2022-49305: drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() (bsc#1238645).
• CVE-2022-49325: tcp: add accessors to read/set tp->snd_cwnd (bsc#1238398).
• CVE-2022-49335: drm/amdgpu/cs: make commands with 0 chunks illegal behaviour (bsc#1238377).
• CVE-2022-49351: net: altera: Fix refcount leak in altera_tse_mdio_create (bsc#1237939).
• CVE-2022-49385: driver: base: fix UAF when driver_attach failed (bsc#1237951).
• CVE-2022-49390: macsec: fix UAF bug for real_dev (bsc#1238233).
• CVE-2022-49411: bfq: Make sure bfqg for which we are queueing requests is online (bsc#1238307).
• CVE-2022-49442: drivers/base/node.c: fix compaction sysfs file leak (bsc#1238243).
• CVE-2022-49465: blk-throttle: Set BIO_THROTTLED when bio has been throttled (bsc#1238919).
• CVE-2022-49478: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init (bsc#1238000).
• CVE-2022-49489: drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume (bsc#1238244).
• CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted (bsc#1238835).
• CVE-2022-49521: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() (bsc#1238938).
• CVE-2022-49525: media: cx25821: Fix the warning when removing the module (bsc#1238022).
• CVE-2022-49534: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT (bsc#1238893).
• CVE-2022-49535: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI (bsc#1238937).
• CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock (bsc#1238838).
• CVE-2022-49537: scsi: lpfc: Fix call trace observed during I/O with CMF enabled (bsc#1238930).
• CVE-2022-49542: scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() (bsc#1238722).
• CVE-2022-49561: netfilter: conntrack: re-fetch conntrack after insertion (bsc#1238537).
• CVE-2022-49590: igmp: Fix data-races around sysctl_igmp_llm_reports (bsc#1238844).
• CVE-2022-49658: bpf, selftests: Add verifier test case for imm=0,umin=0,umax=1 scalar (bsc#1238803).
• CVE-2022-49668: PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events (bsc#1237957).
• CVE-2022-49693: drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (bsc#1237954).
• CVE-2022-49725: i40e: Fix call trace in setup_tx_descriptors…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
• CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720). -…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27415: netfilter: bridge: confirm multicast packets before passing them up the stack (bsc#1224757).
• CVE-2024-28956: Intel CPU: Indirect Target Selection (ITS) (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46763: fou: Fix null-ptr-deref in GRO (bsc#1230764).
• CVE-2024-50038: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (bsc#1231910).
• CVE-2024-50162: bpf: devmap: provide rxq after redirect (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: sockmap, vsock: For connectible sockets allow only connected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21904: caif_virtio: fix wrong pointer check in cfv_probe() (bsc#1240576).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
• CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
• CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
• CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
• CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
• CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
• CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
• CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
• CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
• CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
• CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).

The following non-security bugs were fixed:

• ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (stable-fixes).
• ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (git-fixes).
• ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (git-fixes).
• ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (git-fixes).
• ASoC: imx-card: Add NULL check in imx_card_probe() (git-fixes).
• ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns (git-fixes).
• ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment (git-fixes).
• ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (git-fixes).
• HID:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26708: mptcp: fix inconsistent state on fastopen race (bsc#1222672).
• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-40980: drop_monitor: replace spin_lock by raw_spin_lock (bsc#1227937).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-44974: mptcp: pm: avoid possible UaF when selecting endp (bsc#1230235).
• CVE-2024-45009: mptcp: pm: only decrement add_addr_accepted for MPJ req (bsc#1230438).
• CVE-2024-45010: mptcp: pm: only mark 'subflow' endp as available (bsc#1230439).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync (bsc#1231088).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50085: mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow (bsc#1232508).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset (bsc#1233028).
• CVE-2024-50185: kABI fix for mptcp: handle consistently DSS corruption (bsc#1233109).
• CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248).
• CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size (bsc#1233221).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53123: mptcp: error out earlier on disconnect (bsc#1234070).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53147: exfat: fix out-of-bounds access of directory entries (bsc#1234857).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56592: bpf: Call free_htab_elem() after htab_unlock_bucket() (bsc#1235244).
• CVE-2024-56633: selftests/bpf: Add apply_bytes test to test_txmsg_redir_wait_sndmem in test_sockmap (bsc#1235485).
• CVE-2024-56638: kABI fix for "netfilter: nft_inner: incorrect percpu area handling under softirq" (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-27415: netfilter: br_netfilter: skip conntrack input hook for promisc packets (bsc#1224757).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC (bsc#1240581).
• CVE-2025-21895: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list (bsc#1240585).
• CVE-2025-21906: wifi: iwlwifi: mvm: clean up ROC on failure (bsc#1240587).
• CVE-2025-21908: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback (bsc#1240600).
• CVE-2025-21913: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() (bsc#1240591).
• CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
• CVE-2025-21924: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error (bsc#1240720).
• CVE-2025-21957: scsi: qla1280: Fix kernel oops when debug level > 2 (bsc#1240742).
• CVE-2025-21960: eth: bnxt: do not update checksum in bnxt_xdp_build_skb() (bsc#1240815).
• CVE-2025-21961: eth: bnxt: fix truesize for mb-xdp-pass case (bsc#1240816).
• CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784).
• CVE-2025-21970: net/mlx5: Bridge, fix the crash caused by LAG state check (bsc#1240819).
• CVE-2025-21972: net: mctp: unshare packets when reassembling (bsc#1240813).
• CVE-2025-21975: net/mlx5: handle errors in mlx5_chains_create_table() (bsc#1240812).
• CVE-2025-21981: ice: fix memory leak in aRFS after reset (bsc#1240612).
• CVE-2025-21991: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (bsc#1240795).
• CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
• CVE-2025-2312: CIFS: New mount option for cifs.upcall namespace resolution (bsc#1239684).

The following non-security bugs were fixed:

• ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP (stable-fixes).
• ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers (git-fixes).
• ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA (git-fixes).
• ALSA: hda/realtek: Fix built-in mic on another ASUS VivoBook model (git-fixes).
• ASoC: imx-card: Add NULL check in imx_card_probe() (git-fixes).
• ASoC: qdsp6: q6apm-dai: fix capture pipeline overruns (git-fixes).
• ASoC: qdsp6: q6apm-dai: set 10 ms period and buffer alignment (git-fixes).
• ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path (git-fixes).
• HID:…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Hardware crypto device drivers;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• I3C subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• Network drivers;
• Operating Performance Points (OPP) driver;
• PCI subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• Remote Processor subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• QCOM SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Trusted Execution Environment drivers;
• TTY drivers;
• UFS subsystem;
• USB Device Class drivers;
• USB core drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• SMB network file system;
• UBI file system;
• BPF subsystem;
• Timer subsystem;
• KVM subsystem;
• Networking core;
• ptr_ring data structure definitions;
• Networking subsytem;
• Amateur Radio drivers;
• L3 Master device support module;
• TCP network protocol;
• XFRM subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Process Accounting mechanism;
• Perf events;
• Padata parallel execution mechanism;
• printk logging mechanism;
• Scheduler infrastructure;
• Workqueue subsystem;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• RxRPC session sockets;
• Network traffic control;
• Wireless networking;
• Key management;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• Tomoyo security module;
• SoC audio core drivers;
• SOF drivers; (CVE-2025-21737, CVE-2025-21711, CVE-2025-21987, CVE-2025-21848, CVE-2024-49570, CVE-2025-21762, CVE-2025-21738, CVE-2025-21712, CVE-2025-21719, CVE-2025-21870, CVE-2024-57984, CVE-2025-21815, CVE-2025-21744, CVE-2024-58058, CVE-2024-58078, CVE-2024-57990, CVE-2024-54458, CVE-2025-21899, CVE-2025-21814, CVE-2025-21746, CVE-2024-54456, CVE-2025-21739, CVE-2024-58057, CVE-2025-21855, CVE-2025-21758, CVE-2024-58006, CVE-2024-58007, CVE-2025-21720, CVE-2024-58090, CVE-2025-21852, CVE-2024-57982, CVE-2024-58013, CVE-2024-58082, CVE-2025-21825, CVE-2024-58072, CVE-2024-57996, CVE-2025-21787, CVE-2025-21742, CVE-2025-21705, CVE-2025-21829, CVE-2024-58060, CVE-2025-21811, CVE-2025-21900, CVE-2025-21853, CVE-2025-21809, CVE-2025-21938, CVE-2025-21728, CVE-2025-21785, CVE-2025-21732, CVE-2025-21888, CVE-2025-21768, CVE-2025-21875, CVE-2025-21721, CVE-2025-21766, CVE-2025-21892, CVE-2024-57953, CVE-2025-21772, CVE-2025-21735, CVE-2024-58017, CVE-2024-58086, CVE-2024-58084, CVE-2025-21761, CVE-2024-58008, CVE-2024-57988, CVE-2025-21874, CVE-2024-58011, CVE-2025-21706, CVE-2024-57999, CVE-2025-21858, CVE-2024-58061, CVE-2025-21727, CVE-2025-21780, CVE-2024-58051, CVE-2025-21791, CVE-2025-21788, CVE-2025-21786, CVE-2024-58012, CVE-2024-58010, CVE-2024-58001, CVE-2025-21844, CVE-2025-21708, CVE-2024-57834, CVE-2025-21873,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Hardware crypto device drivers;
• FireWire subsystem;
• EFI core;
• Qualcomm firmware drivers;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• I3C subsystem;
• InfiniBand drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• Network drivers;
• Operating Performance Points (OPP) driver;
• PCI subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• Remote Processor subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• QCOM SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Trusted Execution Environment drivers;
• TTY drivers;
• UFS subsystem;
• USB Device Class drivers;
• USB core drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• Overlay file system;
• SMB network file system;
• UBI file system;
• BPF subsystem;
• Timer subsystem;
• KVM subsystem;
• Networking core;
• ptr_ring data structure definitions;
• Networking subsytem;
• Amateur Radio drivers;
• L3 Master device support module;
• TCP network protocol;
• XFRM subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• Process Accounting mechanism;
• Perf events;
• Padata parallel execution mechanism;
• printk logging mechanism;
• Scheduler infrastructure;
• Workqueue subsystem;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• RxRPC session sockets;
• Network traffic control;
• Wireless networking;
• Key management;
• Landlock security;
• Linux Security Modules (LSM) Framework;
• Tomoyo security module;
• SoC audio core drivers;
• SOF drivers; (CVE-2025-21799, CVE-2025-21765, CVE-2024-57834, CVE-2025-21971, CVE-2025-21855, CVE-2024-58019, CVE-2025-21987, CVE-2025-21754, CVE-2025-21779, CVE-2024-57986, CVE-2025-21809, CVE-2025-21887, CVE-2025-21744, CVE-2024-58014, CVE-2025-21892, CVE-2025-21848, CVE-2024-58051, CVE-2024-58085, CVE-2025-21862, CVE-2024-57981, CVE-2024-57987, CVE-2024-58053, CVE-2024-58063, CVE-2024-58079, CVE-2025-21875, CVE-2025-21715, CVE-2024-58004, CVE-2025-21857, CVE-2025-21856, CVE-2025-21938, CVE-2024-58082, CVE-2025-21815, CVE-2025-21864, CVE-2024-52559, CVE-2024-58078, CVE-2024-57989, CVE-2024-58001, CVE-2025-21889, CVE-2025-21739, CVE-2024-58005, CVE-2025-21829, CVE-2024-58069, CVE-2025-21712, CVE-2025-21846, CVE-2025-21883, CVE-2025-21852, CVE-2025-21808, CVE-2025-21900, CVE-2025-21888, CVE-2025-21784, CVE-2025-21838, CVE-2024-58054, CVE-2025-21781, CVE-2025-21737, CVE-2024-58013, CVE-2025-21885, CVE-2025-21877, CVE-2024-58010, CVE-2025-21844, CVE-2024-58012, CVE-2024-58083, CVE-2025-21783, CVE-2025-21798, CVE-2024-57973, CVE-2024-57982, CVE-2025-21708, CVE-2024-58003, CVE-2025-21786, CVE-2025-21750, CVE-2025-21870, CVE-2025-21745, CVE-2024-58081, CVE-2024-57979, CVE-2025-21718, CVE-2025-21816, CVE-2025-21868, CVE-2025-21731, CVE-2025-21814, CVE-2025-21826, CVE-2024-58006, CVE-2025-21821, CVE-2024-57852, CVE-2025-21746,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-22008, CVE-2025-21872, CVE-2025-21945, CVE-2025-37889, CVE-2025-21997, CVE-2025-21935, CVE-2025-21986, CVE-2025-21890, CVE-2025-21925, CVE-2024-58090, CVE-2025-38569, CVE-2025-21911, CVE-2025-21957, CVE-2025-21891, CVE-2025-21924, CVE-2025-21956, CVE-2025-21994, CVE-2025-22013, CVE-2025-21964, CVE-2025-21909, CVE-2025-21888, CVE-2025-21918, CVE-2025-21981, CVE-2025-21966, CVE-2025-22011, CVE-2025-21877, CVE-2025-21913, CVE-2025-21895, CVE-2025-21929, CVE-2025-22010, CVE-2025-21992, CVE-2025-21930, CVE-2025-21982, CVE-2025-21894, CVE-2025-21934, CVE-2025-21873, CVE-2025-21914, CVE-2025-21941, CVE-2025-21962, CVE-2025-22014, CVE-2025-21905, CVE-2025-21908, CVE-2025-21898, CVE-2025-21878, CVE-2025-22009, CVE-2025-21961, CVE-2025-22015, CVE-2025-21883, CVE-2025-21916, CVE-2025-22016, CVE-2025-21936, CVE-2025-21947, CVE-2025-21927, CVE-2025-22004, CVE-2025-21926, CVE-2025-21969, CVE-2025-21976, CVE-2025-21912, CVE-2025-21920, CVE-2025-21951, CVE-2025-22005, CVE-2025-21978, CVE-2025-21975, CVE-2025-22007, CVE-2025-21928, CVE-2025-21968, CVE-2025-21963, CVE-2025-21977, CVE-2025-21915, CVE-2025-21980, CVE-2025-22047, CVE-2025-21972, CVE-2025-21892, CVE-2025-22003, CVE-2025-21979, CVE-2025-21944, CVE-2025-21880, CVE-2025-21899, CVE-2025-21995, CVE-2025-22017, CVE-2025-21946, CVE-2025-22001, CVE-2025-21904, CVE-2025-21881, CVE-2025-21917, CVE-2025-21970, CVE-2025-21889, CVE-2025-21922, CVE-2025-21875, CVE-2025-21919, CVE-2025-21991, CVE-2025-21967, CVE-2025-21960, CVE-2025-21959, CVE-2025-21955, CVE-2025-21996, CVE-2025-21950, CVE-2025-21937, CVE-2025-21948, CVE-2025-21903, CVE-2025-21885, CVE-2025-21999, CVE-2025-21910)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21945, CVE-2025-21991, CVE-2025-22008, CVE-2025-21996, CVE-2025-21924, CVE-2025-21986, CVE-2025-21872, CVE-2025-21962, CVE-2025-22007, CVE-2025-37889, CVE-2025-21889, CVE-2025-21968, CVE-2025-21903, CVE-2025-21955, CVE-2025-21982, CVE-2025-21929, CVE-2025-21944, CVE-2025-22004, CVE-2025-21997, CVE-2025-21941, CVE-2025-22047, CVE-2025-21915, CVE-2025-21995, CVE-2025-22011, CVE-2025-21891, CVE-2025-22009, CVE-2025-22015, CVE-2024-58090, CVE-2025-21947, CVE-2025-21976, CVE-2025-21964, CVE-2025-21904, CVE-2025-21880, CVE-2025-21918, CVE-2025-21950, CVE-2025-21948, CVE-2025-21888, CVE-2025-22014, CVE-2025-21963, CVE-2025-21875, CVE-2025-21967, CVE-2025-21972, CVE-2025-21895, CVE-2025-21961, CVE-2025-21926, CVE-2025-21892, CVE-2025-21916, CVE-2025-21894, CVE-2025-21930, CVE-2025-21927, CVE-2025-21911, CVE-2025-21936, CVE-2025-21881, CVE-2025-38569, CVE-2025-21873, CVE-2025-21951, CVE-2025-22003, CVE-2025-21877, CVE-2025-21908, CVE-2025-21956, CVE-2025-21977, CVE-2025-21917, CVE-2025-21922, CVE-2025-21959, CVE-2025-22005, CVE-2025-22017, CVE-2025-22016, CVE-2025-21878, CVE-2025-21970, CVE-2025-21905, CVE-2025-21978, CVE-2025-21981, CVE-2025-21980, CVE-2025-21910, CVE-2025-21925, CVE-2025-21885, CVE-2025-21946, CVE-2025-21937, CVE-2025-21919, CVE-2025-22013, CVE-2025-21883, CVE-2025-21957, CVE-2025-21914, CVE-2025-21909, CVE-2025-21934, CVE-2025-21975, CVE-2025-21912, CVE-2025-21969, CVE-2025-21898, CVE-2025-21890, CVE-2025-21899, CVE-2025-22001, CVE-2025-21979, CVE-2025-21966, CVE-2025-21935, CVE-2025-21920, CVE-2025-21913, CVE-2025-22010, CVE-2025-21992, CVE-2025-21960, CVE-2025-21994, CVE-2025-21999, CVE-2025-21928)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21980, CVE-2025-21999, CVE-2025-21991, CVE-2025-21937, CVE-2025-22016, CVE-2025-21920, CVE-2025-21979, CVE-2025-21919, CVE-2025-21969, CVE-2025-21872, CVE-2025-21996, CVE-2025-21927, CVE-2025-21904, CVE-2025-22013, CVE-2025-21928, CVE-2025-21891, CVE-2025-21889, CVE-2025-21972, CVE-2025-21981, CVE-2025-38569, CVE-2025-21910, CVE-2025-21945, CVE-2025-22011, CVE-2025-21916, CVE-2025-21924, CVE-2025-21922, CVE-2025-21975, CVE-2025-21880, CVE-2025-21995, CVE-2025-21977, CVE-2025-21947, CVE-2025-21914, CVE-2025-21905, CVE-2025-22009, CVE-2025-21892, CVE-2025-22005, CVE-2024-58090, CVE-2025-21926, CVE-2025-37889, CVE-2025-21966, CVE-2025-21955, CVE-2025-22007, CVE-2025-21894, CVE-2025-21909, CVE-2025-21883, CVE-2025-21992, CVE-2025-21976, CVE-2025-21890, CVE-2025-21898, CVE-2025-21982, CVE-2025-21877, CVE-2025-21925, CVE-2025-21970, CVE-2025-21930, CVE-2025-21946, CVE-2025-22017, CVE-2025-21908, CVE-2025-21944, CVE-2025-21885, CVE-2025-22010, CVE-2025-21917, CVE-2025-21918, CVE-2025-21934, CVE-2025-21950, CVE-2025-21963, CVE-2025-22003, CVE-2025-21961, CVE-2025-21967, CVE-2025-21878, CVE-2025-21895, CVE-2025-21913, CVE-2025-21875, CVE-2025-21959, CVE-2025-22008, CVE-2025-21968, CVE-2025-21936, CVE-2025-21956, CVE-2025-21903, CVE-2025-22004, CVE-2025-21986, CVE-2025-21915, CVE-2025-21964, CVE-2025-22014, CVE-2025-21994, CVE-2025-21912, CVE-2025-21873, CVE-2025-21957, CVE-2025-22015, CVE-2025-21997, CVE-2025-21948, CVE-2025-21951, CVE-2025-21962, CVE-2025-22001, CVE-2025-21978, CVE-2025-21960, CVE-2025-22047, CVE-2025-21935, CVE-2025-21899, CVE-2025-21911, CVE-2025-21881, CVE-2025-21929, CVE-2025-21941)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21961, CVE-2025-21895, CVE-2025-21934, CVE-2025-21898, CVE-2024-58090, CVE-2025-21999, CVE-2025-22004, CVE-2025-21966, CVE-2025-21922, CVE-2025-21920, CVE-2025-21911, CVE-2025-21885, CVE-2025-21912, CVE-2025-21996, CVE-2025-21924, CVE-2025-21914, CVE-2025-21936, CVE-2025-21944, CVE-2025-21877, CVE-2025-21909, CVE-2025-21986, CVE-2025-21890, CVE-2025-22009, CVE-2025-21905, CVE-2025-21969, CVE-2025-21935, CVE-2025-21917, CVE-2025-22008, CVE-2025-21994, CVE-2025-21980, CVE-2025-22014, CVE-2025-21915, CVE-2025-21991, CVE-2025-22015, CVE-2025-21875, CVE-2025-21975, CVE-2025-21878, CVE-2025-21930, CVE-2025-21967, CVE-2025-21908, CVE-2025-22007, CVE-2025-21899, CVE-2025-21950, CVE-2025-21959, CVE-2025-21937, CVE-2025-22010, CVE-2025-21945, CVE-2025-21997, CVE-2025-21992, CVE-2025-22003, CVE-2025-22013, CVE-2025-21963, CVE-2025-22001, CVE-2025-21927, CVE-2025-21894, CVE-2025-21960, CVE-2025-21956, CVE-2025-21948, CVE-2025-21929, CVE-2025-21919, CVE-2025-21972, CVE-2025-21883, CVE-2025-21880, CVE-2025-21976, CVE-2025-22005, CVE-2025-22016, CVE-2025-21978, CVE-2025-21873, CVE-2025-21925, CVE-2025-21904, CVE-2025-21928, CVE-2025-21892, CVE-2025-21891, CVE-2025-21995, CVE-2025-21968, CVE-2025-21982, CVE-2025-21918, CVE-2025-21889, CVE-2025-21970, CVE-2025-21910, CVE-2025-21913, CVE-2025-21926, CVE-2025-21955, CVE-2025-21947, CVE-2025-21979, CVE-2025-21981, CVE-2025-22011, CVE-2025-21888, CVE-2025-37889, CVE-2025-21957, CVE-2025-21977, CVE-2025-21903, CVE-2025-21946, CVE-2025-21941, CVE-2025-21964, CVE-2025-21951, CVE-2025-21962, CVE-2025-22017, CVE-2025-21872, CVE-2025-21881, CVE-2025-21916)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21966, CVE-2025-21895, CVE-2025-21944, CVE-2025-21986, CVE-2025-21918, CVE-2025-21873, CVE-2025-21963, CVE-2025-21929, CVE-2025-21995, CVE-2025-22017, CVE-2025-21991, CVE-2025-21960, CVE-2025-21946, CVE-2025-21976, CVE-2025-21922, CVE-2025-21925, CVE-2025-21903, CVE-2025-21978, CVE-2025-21979, CVE-2025-22016, CVE-2025-21936, CVE-2025-21997, CVE-2025-21992, CVE-2025-21920, CVE-2025-21875, CVE-2025-21934, CVE-2025-21919, CVE-2025-21972, CVE-2025-22001, CVE-2025-21981, CVE-2025-21910, CVE-2025-21969, CVE-2025-22010, CVE-2025-21908, CVE-2025-21957, CVE-2025-22009, CVE-2025-21927, CVE-2025-21930, CVE-2025-21994, CVE-2025-21980, CVE-2025-21885, CVE-2025-21967, CVE-2025-21899, CVE-2025-21890, CVE-2025-21948, CVE-2025-21964, CVE-2025-21911, CVE-2025-21982, CVE-2025-21883, CVE-2025-21913, CVE-2025-21917, CVE-2025-21905, CVE-2025-21968, CVE-2025-22013, CVE-2025-22005, CVE-2025-21916, CVE-2025-21880, CVE-2025-21881, CVE-2025-22003, CVE-2025-21892, CVE-2025-21937, CVE-2025-21970, CVE-2025-22004, CVE-2025-21950, CVE-2025-21924, CVE-2025-21894, CVE-2025-21904, CVE-2025-21915, CVE-2025-21889, CVE-2025-21912, CVE-2025-21909, CVE-2025-21888, CVE-2025-21935, CVE-2025-22008, CVE-2025-37889, CVE-2025-21878, CVE-2025-21926, CVE-2025-22011, CVE-2025-21962, CVE-2025-22007, CVE-2025-21941, CVE-2025-21898, CVE-2025-21956, CVE-2025-22015, CVE-2025-21961, CVE-2025-21872, CVE-2025-21891, CVE-2025-21947, CVE-2025-21955, CVE-2025-21877, CVE-2025-21996, CVE-2025-21977, CVE-2025-21945, CVE-2025-21914, CVE-2025-21975, CVE-2024-58090, CVE-2025-21959, CVE-2025-22014, CVE-2025-21951, CVE-2025-21928, CVE-2025-21999)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21964, CVE-2025-21890, CVE-2025-21934, CVE-2025-21929, CVE-2025-21922, CVE-2025-21970, CVE-2025-21913, CVE-2025-21937, CVE-2025-21872, CVE-2025-21972, CVE-2025-21892, CVE-2025-21991, CVE-2025-21967, CVE-2025-21894, CVE-2025-21881, CVE-2025-21885, CVE-2025-21999, CVE-2025-21978, CVE-2025-22001, CVE-2025-21979, CVE-2025-21951, CVE-2025-22003, CVE-2025-21963, CVE-2025-21936, CVE-2025-21891, CVE-2025-21941, CVE-2025-21895, CVE-2025-21982, CVE-2025-21919, CVE-2025-21961, CVE-2025-21946, CVE-2025-21889, CVE-2025-21899, CVE-2025-21873, CVE-2025-37889, CVE-2025-22008, CVE-2025-21969, CVE-2025-21957, CVE-2025-21925, CVE-2025-21945, CVE-2025-21927, CVE-2025-21878, CVE-2025-21995, CVE-2025-21981, CVE-2025-21956, CVE-2025-21909, CVE-2025-21955, CVE-2025-21918, CVE-2025-21960, CVE-2025-21915, CVE-2025-21992, CVE-2025-21914, CVE-2025-21877, CVE-2025-21875, CVE-2025-21928, CVE-2025-22013, CVE-2025-22014, CVE-2025-21950, CVE-2025-21948, CVE-2025-21912, CVE-2025-21944, CVE-2025-22004, CVE-2025-22009, CVE-2025-21968, CVE-2025-21888, CVE-2025-21980, CVE-2025-21911, CVE-2025-22017, CVE-2025-21975, CVE-2025-21930, CVE-2025-21947, CVE-2025-21908, CVE-2025-21994, CVE-2024-58090, CVE-2025-21910, CVE-2025-21959, CVE-2025-21977, CVE-2025-21903, CVE-2025-22016, CVE-2025-21976, CVE-2025-21898, CVE-2025-21986, CVE-2025-22011, CVE-2025-21905, CVE-2025-22015, CVE-2025-21996, CVE-2025-21966, CVE-2025-21883, CVE-2025-22010, CVE-2025-21904, CVE-2025-21916, CVE-2025-21935, CVE-2025-21924, CVE-2025-22005, CVE-2025-21962, CVE-2025-21917, CVE-2025-21920, CVE-2025-21997, CVE-2025-21880, CVE-2025-21926, CVE-2025-22007)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Overlay file system;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-22017, CVE-2025-22003, CVE-2025-22009, CVE-2025-22015, CVE-2025-21934, CVE-2025-21908, CVE-2025-21885, CVE-2025-21979, CVE-2025-21887, CVE-2025-21922, CVE-2025-21944, CVE-2025-21905, CVE-2025-21969, CVE-2025-21904, CVE-2025-21926, CVE-2025-21951, CVE-2025-21997, CVE-2025-21920, CVE-2025-21994, CVE-2025-21977, CVE-2025-21976, CVE-2025-21975, CVE-2025-21972, CVE-2025-22013, CVE-2025-21894, CVE-2025-21963, CVE-2025-21978, CVE-2025-38569, CVE-2025-21936, CVE-2025-21873, CVE-2025-22010, CVE-2025-21981, CVE-2025-22005, CVE-2025-21959, CVE-2025-21929, CVE-2025-21927, CVE-2025-21966, CVE-2025-22008, CVE-2025-21957, CVE-2025-21970, CVE-2025-21968, CVE-2025-21889, CVE-2025-22047, CVE-2025-21881, CVE-2025-21956, CVE-2025-22011, CVE-2025-21986, CVE-2025-21892, CVE-2025-21964, CVE-2025-21899, CVE-2025-21877, CVE-2025-21875, CVE-2025-21912, CVE-2025-22001, CVE-2025-38350, CVE-2025-21991, CVE-2025-21930, CVE-2025-21962, CVE-2025-21880, CVE-2024-57996, CVE-2025-21914, CVE-2025-22014, CVE-2025-21888, CVE-2025-21955, CVE-2025-21937, CVE-2025-21924, CVE-2025-21895, CVE-2025-21947, CVE-2025-21946, CVE-2025-21878, CVE-2025-21918, CVE-2025-21913, CVE-2025-21945, CVE-2025-37752, CVE-2025-21935, CVE-2025-21950, CVE-2025-21960, CVE-2024-58090, CVE-2025-21992, CVE-2025-21961, CVE-2025-21948, CVE-2025-21982, CVE-2025-21910, CVE-2025-21909, CVE-2025-21925, CVE-2025-37889, CVE-2025-21967, CVE-2025-21898, CVE-2025-22007, CVE-2025-21995, CVE-2025-22016, CVE-2025-21891, CVE-2025-21911, CVE-2025-21890, CVE-2025-21999, CVE-2025-22004, CVE-2025-21915, CVE-2025-21996, CVE-2025-21980, CVE-2025-21903, CVE-2025-21916, CVE-2025-21941, CVE-2025-21928, CVE-2025-21919, CVE-2025-21883, CVE-2025-21872, CVE-2025-21917)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21944, CVE-2025-21927, CVE-2025-21996, CVE-2025-21928, CVE-2025-21888, CVE-2025-21995, CVE-2025-21929, CVE-2025-21873, CVE-2025-21875, CVE-2025-21894, CVE-2025-21878, CVE-2025-21977, CVE-2024-58090, CVE-2025-21872, CVE-2025-21905, CVE-2025-21963, CVE-2025-21991, CVE-2025-21947, CVE-2025-21924, CVE-2025-21899, CVE-2025-21992, CVE-2025-21909, CVE-2025-21920, CVE-2025-21917, CVE-2025-21972, CVE-2025-21997, CVE-2025-21999, CVE-2025-21895, CVE-2025-22013, CVE-2025-21936, CVE-2025-21881, CVE-2025-21956, CVE-2025-22010, CVE-2025-22015, CVE-2025-21959, CVE-2025-21980, CVE-2025-22017, CVE-2025-22005, CVE-2025-21935, CVE-2025-21911, CVE-2025-21914, CVE-2025-22001, CVE-2025-21913, CVE-2025-22007, CVE-2025-21966, CVE-2025-21962, CVE-2025-21908, CVE-2025-21910, CVE-2025-22014, CVE-2025-22016, CVE-2025-21957, CVE-2025-21968, CVE-2025-21986, CVE-2025-21981, CVE-2025-21880, CVE-2025-21950, CVE-2025-21982, CVE-2025-21976, CVE-2025-21979, CVE-2025-21912, CVE-2025-21951, CVE-2025-21994, CVE-2025-21946, CVE-2025-21955, CVE-2025-21898, CVE-2025-21960, CVE-2025-21883, CVE-2025-21970, CVE-2025-21891, CVE-2025-21919, CVE-2025-21964, CVE-2025-21926, CVE-2025-21877, CVE-2025-21903, CVE-2025-21978, CVE-2025-21885, CVE-2025-21948, CVE-2025-21930, CVE-2025-22009, CVE-2025-21918, CVE-2025-21890, CVE-2025-21925, CVE-2025-22003, CVE-2025-22008, CVE-2025-21934, CVE-2025-21961, CVE-2025-22004, CVE-2025-21941, CVE-2025-21915, CVE-2025-21967, CVE-2025-21904, CVE-2025-21916, CVE-2025-37889, CVE-2025-21922, CVE-2025-21892, CVE-2025-21975, CVE-2025-21945, CVE-2025-21889, CVE-2025-21937, CVE-2025-21969)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Ext4 file system;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Switch device API;
• TLS protocol;
• VMware vSockets driver;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem; (CVE-2025-38617, CVE-2025-21898, CVE-2025-21996, CVE-2025-21903, CVE-2025-21980, CVE-2025-22007, CVE-2025-22010, CVE-2025-37756, CVE-2025-21970, CVE-2025-21930, CVE-2025-37785, CVE-2025-22015, CVE-2025-21927, CVE-2025-21914, CVE-2025-21963, CVE-2025-22004, CVE-2025-21934, CVE-2025-21986, CVE-2025-22008, CVE-2025-21895, CVE-2025-21928, CVE-2025-21899, CVE-2025-21891, CVE-2025-21925, CVE-2025-21979, CVE-2025-21945, CVE-2025-22005, CVE-2025-21880, CVE-2025-21946, CVE-2025-21957, CVE-2025-21890, CVE-2025-21955, CVE-2025-21961, CVE-2025-21935, CVE-2025-21959, CVE-2025-37889, CVE-2025-21894, CVE-2024-58090, CVE-2025-22001, CVE-2025-21924, CVE-2025-21909, CVE-2025-22009, CVE-2025-21892, CVE-2025-21976, CVE-2025-21875, CVE-2025-21915, CVE-2025-21967, CVE-2025-38618, CVE-2025-21918, CVE-2025-21881, CVE-2025-21872, CVE-2025-21873, CVE-2025-21960, CVE-2025-22014, CVE-2025-21885, CVE-2025-21950, CVE-2025-21981, CVE-2025-21917, CVE-2025-21913, CVE-2025-21972, CVE-2025-21975, CVE-2025-21977, CVE-2025-21951, CVE-2025-21962, CVE-2025-38500, CVE-2025-21916, CVE-2025-21888, CVE-2025-21910, CVE-2025-21994, CVE-2025-21904, CVE-2025-21947, CVE-2025-21995, CVE-2025-22013, CVE-2025-21920, CVE-2025-21997, CVE-2025-21905, CVE-2025-21941, CVE-2025-21877, CVE-2025-21878, CVE-2025-21937, CVE-2025-21966, CVE-2025-21919, CVE-2025-21992, CVE-2025-21948, CVE-2025-21922, CVE-2025-21911, CVE-2025-21926, CVE-2025-21908, CVE-2025-21956, CVE-2025-22003, CVE-2025-21969, CVE-2025-21999, CVE-2025-38477, CVE-2025-21944, CVE-2025-21936, CVE-2025-21978, CVE-2025-21991, CVE-2025-21912, CVE-2025-21968, CVE-2025-22017, CVE-2025-21883, CVE-2025-21964, CVE-2025-21889, CVE-2025-21982, CVE-2025-22016, CVE-2025-21929)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Ext4 file system;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Switch device API;
• TLS protocol;
• VMware vSockets driver;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem; (CVE-2025-21928, CVE-2025-21976, CVE-2025-21890, CVE-2025-21929, CVE-2025-21960, CVE-2025-21978, CVE-2025-21937, CVE-2025-21908, CVE-2025-21999, CVE-2025-22015, CVE-2025-21967, CVE-2025-21913, CVE-2025-21898, CVE-2025-37756, CVE-2025-38617, CVE-2025-21927, CVE-2025-21956, CVE-2025-21979, CVE-2025-21955, CVE-2025-21895, CVE-2025-21969, CVE-2025-21877, CVE-2025-21936, CVE-2025-22001, CVE-2025-37889, CVE-2025-21875, CVE-2025-21888, CVE-2025-21911, CVE-2025-21904, CVE-2025-21878, CVE-2025-21961, CVE-2025-22013, CVE-2025-21986, CVE-2025-21915, CVE-2025-21889, CVE-2025-21903, CVE-2025-21909, CVE-2025-21950, CVE-2025-21885, CVE-2025-21966, CVE-2025-21873, CVE-2025-21883, CVE-2025-21946, CVE-2025-22003, CVE-2025-22014, CVE-2024-58090, CVE-2025-21891, CVE-2025-21962, CVE-2025-21948, CVE-2025-21924, CVE-2025-22017, CVE-2025-21975, CVE-2025-21920, CVE-2025-21972, CVE-2025-21964, CVE-2025-21917, CVE-2025-21894, CVE-2025-21982, CVE-2025-21945, CVE-2025-21996, CVE-2025-21995, CVE-2025-21912, CVE-2025-21910, CVE-2025-21980, CVE-2025-21951, CVE-2025-21934, CVE-2025-21994, CVE-2025-37785, CVE-2025-22009, CVE-2025-38618, CVE-2025-21992, CVE-2025-21930, CVE-2025-21941, CVE-2025-21916, CVE-2025-22004, CVE-2025-21919, CVE-2025-21880, CVE-2025-21963, CVE-2025-21914, CVE-2025-21981, CVE-2025-38500, CVE-2025-22005, CVE-2025-21959, CVE-2025-21899, CVE-2025-21926, CVE-2025-21968, CVE-2025-21944, CVE-2025-22016, CVE-2025-38477, CVE-2025-22008, CVE-2025-21925, CVE-2025-21997, CVE-2025-21935, CVE-2025-21947, CVE-2025-22010, CVE-2025-21977, CVE-2025-21922, CVE-2025-21881, CVE-2025-21970, CVE-2025-22007, CVE-2025-21991, CVE-2025-21918, CVE-2025-21905, CVE-2025-22011, CVE-2025-21872, CVE-2025-21957, CVE-2025-21892)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Ext4 file system;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Switch device API;
• TLS protocol;
• VMware vSockets driver;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem; (CVE-2025-21911, CVE-2025-21937, CVE-2025-21951, CVE-2025-21948, CVE-2025-22017, CVE-2025-21982, CVE-2025-21927, CVE-2025-21935, CVE-2025-21944, CVE-2025-21917, CVE-2025-21895, CVE-2025-21966, CVE-2025-21975, CVE-2025-21945, CVE-2025-21964, CVE-2025-22001, CVE-2025-21955, CVE-2025-21980, CVE-2025-21925, CVE-2025-21957, CVE-2025-22003, CVE-2025-21999, CVE-2025-21969, CVE-2025-21885, CVE-2025-21996, CVE-2025-21883, CVE-2025-21908, CVE-2025-21978, CVE-2025-21894, CVE-2025-21929, CVE-2025-21910, CVE-2025-21979, CVE-2025-21961, CVE-2025-21915, CVE-2025-21916, CVE-2025-22008, CVE-2025-37785, CVE-2025-21873, CVE-2025-21922, CVE-2025-21936, CVE-2025-22015, CVE-2025-22016, CVE-2025-21913, CVE-2025-22009, CVE-2025-21928, CVE-2025-21899, CVE-2025-22007, CVE-2025-21898, CVE-2025-21946, CVE-2025-21920, CVE-2025-22005, CVE-2025-21872, CVE-2025-21962, CVE-2025-21888, CVE-2025-21934, CVE-2025-38618, CVE-2025-22010, CVE-2025-22014, CVE-2024-58090, CVE-2025-21941, CVE-2025-21968, CVE-2025-21972, CVE-2025-21977, CVE-2025-22013, CVE-2025-21959, CVE-2025-21919, CVE-2025-21950, CVE-2025-21926, CVE-2025-21892, CVE-2025-21880, CVE-2025-21994, CVE-2025-21909, CVE-2025-21976, CVE-2025-21956, CVE-2025-21947, CVE-2025-21981, CVE-2025-21877, CVE-2025-21995, CVE-2025-21918, CVE-2025-38500, CVE-2025-22004, CVE-2025-37756, CVE-2025-21970, CVE-2025-21891, CVE-2025-21924, CVE-2025-38477, CVE-2025-21878, CVE-2025-21881, CVE-2025-21904, CVE-2025-21960, CVE-2025-21992, CVE-2025-37889, CVE-2025-21997, CVE-2025-38617, CVE-2025-21963, CVE-2025-21890, CVE-2025-21903, CVE-2025-21912, CVE-2025-22011, CVE-2025-21889, CVE-2025-21991, CVE-2025-21914, CVE-2025-21905, CVE-2025-21986, CVE-2025-21930, CVE-2025-21875, CVE-2025-21967)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Ext4 file system;
• Network file system (NFS) client;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Switch device API;
• TLS protocol;
• VMware vSockets driver;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem; (CVE-2025-21969, CVE-2025-21976, CVE-2025-21898, CVE-2025-21981, CVE-2025-21929, CVE-2025-21935, CVE-2025-22009, CVE-2025-21967, CVE-2025-21963, CVE-2025-21944, CVE-2025-21970, CVE-2025-21962, CVE-2025-21912, CVE-2025-38477, CVE-2025-21977, CVE-2025-21881, CVE-2025-21980, CVE-2025-22013, CVE-2025-21946, CVE-2025-22008, CVE-2025-21975, CVE-2025-21878, CVE-2025-21891, CVE-2025-22014, CVE-2025-21916, CVE-2025-21950, CVE-2024-58090, CVE-2025-21917, CVE-2025-21885, CVE-2025-21914, CVE-2025-21873, CVE-2025-21959, CVE-2025-21964, CVE-2025-22010, CVE-2025-21928, CVE-2025-21872, CVE-2025-21908, CVE-2025-22004, CVE-2025-21895, CVE-2025-21991, CVE-2025-21936, CVE-2025-21982, CVE-2025-21996, CVE-2025-21888, CVE-2025-21961, CVE-2025-21894, CVE-2025-21966, CVE-2025-21941, CVE-2025-21890, CVE-2025-21930, CVE-2025-21883, CVE-2025-21903, CVE-2025-21922, CVE-2025-21945, CVE-2025-22005, CVE-2025-22016, CVE-2025-21926, CVE-2025-21927, CVE-2025-21924, CVE-2025-21919, CVE-2025-21997, CVE-2025-21986, CVE-2025-21905, CVE-2025-21995, CVE-2025-38617, CVE-2025-21875, CVE-2025-21910, CVE-2025-21920, CVE-2025-21913, CVE-2025-21909, CVE-2025-21911, CVE-2025-22001, CVE-2025-21972, CVE-2025-37785, CVE-2025-21889, CVE-2025-21979, CVE-2025-21918, CVE-2025-22011, CVE-2025-37756, CVE-2025-21992, CVE-2025-38618, CVE-2025-21915, CVE-2025-38500, CVE-2025-21978, CVE-2025-21947, CVE-2025-21951, CVE-2025-21994, CVE-2025-21999, CVE-2025-21960, CVE-2025-37889, CVE-2025-21892, CVE-2025-21934, CVE-2025-21877, CVE-2025-22007, CVE-2025-22003, CVE-2025-22017, CVE-2025-21925, CVE-2025-21880, CVE-2025-21957, CVE-2025-21899, CVE-2025-21956, CVE-2025-21948, CVE-2025-21955, CVE-2025-21937, CVE-2025-21968, CVE-2025-21904, CVE-2025-22015)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Network file system (NFS) client;
• Overlay file system;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Network traffic control;
• Switch device API;
• Wireless networking;
• eXpress Data Path; (CVE-2025-21935, CVE-2025-21967, CVE-2025-21908, CVE-2025-22004, CVE-2025-21926, CVE-2025-21927, CVE-2025-21995, CVE-2025-21895, CVE-2025-21936, CVE-2025-21948, CVE-2025-21969, CVE-2025-21972, CVE-2025-21951, CVE-2025-22017, CVE-2025-21962, CVE-2025-21917, CVE-2025-22013, CVE-2025-21991, CVE-2025-22009, CVE-2025-22016, CVE-2024-57996, CVE-2025-21966, CVE-2025-21947, CVE-2025-21928, CVE-2025-21959, CVE-2025-21910, CVE-2025-21957, CVE-2025-21978, CVE-2025-21887, CVE-2025-37954, CVE-2025-21996, CVE-2025-21979, CVE-2025-37889, CVE-2025-21930, CVE-2025-21980, CVE-2025-21878, CVE-2025-21918, CVE-2025-21889, CVE-2024-58090, CVE-2025-22011, CVE-2025-21955, CVE-2025-21904, CVE-2025-21894, CVE-2025-21892, CVE-2025-21945, CVE-2025-21994, CVE-2025-21986, CVE-2025-21912, CVE-2025-21968, CVE-2025-21976, CVE-2025-21898, CVE-2025-21875, CVE-2025-21964, CVE-2025-21963, CVE-2025-21960, CVE-2025-21999, CVE-2025-21997, CVE-2025-21916, CVE-2025-21891, CVE-2025-21920, CVE-2025-21909, CVE-2025-21944, CVE-2025-21883, CVE-2025-22005, CVE-2025-22007, CVE-2025-21911, CVE-2025-21992, CVE-2025-21919, CVE-2025-22003, CVE-2025-21915, CVE-2025-21970, CVE-2025-21903, CVE-2025-21899, CVE-2025-21880, CVE-2025-21956, CVE-2025-21934, CVE-2025-21925, CVE-2025-21941, CVE-2025-21977, CVE-2025-21975, CVE-2025-21913, CVE-2025-21981, CVE-2025-21872, CVE-2025-37752, CVE-2025-22008, CVE-2025-21905, CVE-2025-21888, CVE-2025-38350, CVE-2025-21922, CVE-2025-21937, CVE-2025-21950, CVE-2025-21924, CVE-2025-22014, CVE-2025-22001, CVE-2025-21885, CVE-2025-21881, CVE-2025-21929, CVE-2025-21914, CVE-2025-21877, CVE-2025-22015, CVE-2025-21961, CVE-2025-22010, CVE-2025-21982, CVE-2025-21890, CVE-2025-21946, CVE-2025-21873)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Bus devices;
• AMD CDX bus driver;
• DPLL subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• Multiple devices driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• Pin controllers subsystem;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SLIMbus drivers;
• QCOM SoC drivers;
• UFS subsystem;
• USB DSL drivers;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Framebuffer layer;
• ACRN Hypervisor Service Module driver;
• Ext4 file system;
• Network file system (NFS) client;
• Overlay file system;
• Proc file system;
• SMB network file system;
• Memory Management;
• Scheduler infrastructure;
• SoC audio core drivers;
• Perf events;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Bluetooth subsystem;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Switch device API;
• TLS protocol;
• VMware vSockets driver;
• Wireless networking;
• eXpress Data Path;
• XFRM subsystem; (CVE-2025-21976, CVE-2025-21890, CVE-2025-38617, CVE-2025-21945, CVE-2025-21878, CVE-2025-21925, CVE-2025-21927, CVE-2025-21997, CVE-2025-21919, CVE-2025-21979, CVE-2025-21899, CVE-2025-21955, CVE-2025-21967, CVE-2024-57996, CVE-2025-22014, CVE-2025-21956, CVE-2025-21887, CVE-2025-37785, CVE-2025-21935, CVE-2024-58090, CVE-2025-21975, CVE-2025-21969, CVE-2025-21914, CVE-2025-21963, CVE-2025-21934, CVE-2025-21872, CVE-2025-21961, CVE-2025-38244, CVE-2025-21908, CVE-2025-21920, CVE-2025-21980, CVE-2025-21904, CVE-2025-22008, CVE-2025-21911, CVE-2025-21880, CVE-2025-21928, CVE-2025-21885, CVE-2025-21913, CVE-2025-37752, CVE-2025-22015, CVE-2025-38500, CVE-2025-22013, CVE-2025-21970, CVE-2025-21877, CVE-2025-21916, CVE-2025-21889, CVE-2025-21982, CVE-2025-22001, CVE-2025-22007, CVE-2025-22016, CVE-2025-21981, CVE-2025-37756, CVE-2025-21962, CVE-2025-21891, CVE-2025-21968, CVE-2025-21936, CVE-2025-21995, CVE-2025-21922, CVE-2025-21930, CVE-2025-21894, CVE-2025-38477, CVE-2025-22011, CVE-2025-21991, CVE-2025-38618, CVE-2025-22003, CVE-2025-21903, CVE-2025-21986, CVE-2025-21941, CVE-2025-21951, CVE-2025-22004, CVE-2025-21929, CVE-2025-21917, CVE-2025-21915, CVE-2025-21977, CVE-2025-21875, CVE-2025-21959, CVE-2025-22017, CVE-2025-21881, CVE-2025-21937, CVE-2025-22009, CVE-2025-38350, CVE-2025-21944, CVE-2025-21918, CVE-2025-21947, CVE-2025-21883, CVE-2025-21892, CVE-2025-21966, CVE-2025-21950, CVE-2025-21926, CVE-2025-37954, CVE-2025-21999, CVE-2025-21992, CVE-2025-21948, CVE-2025-21960, CVE-2025-21924, CVE-2025-21873, CVE-2025-21895, CVE-2025-21946, CVE-2025-37889, CVE-2025-21978, CVE-2025-21905, CVE-2025-22010, CVE-2025-38683, CVE-2025-21898, CVE-2025-21910, CVE-2025-21994, CVE-2025-21996, CVE-2025-21972, CVE-2025-21912, CVE-2025-22005, CVE-2025-21909, CVE-2025-21957, CVE-2025-21964)